An example log is helpful here, but you simply splunk the logs, create a field called user if it doesn't exist already, and then run the search. For example, if I want to see this result for the past 30 days: sourcetype=mysecurelog earliest=-30d latest=now | top user limit=5 ... View more

That sounds like something went wrong. Check Splunk logs, your configuration, etc. - make sure you're following the docs, such as this: http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Updatepeerconfigurations Pushing the bundle from the master to the peers is the only supported method of distributing peer configurations. ... View more

The point I was making is that your requirements don't add up - how do you know that you need 30 days of cold data, if you don't know how much data you have in hot/warm? If you're indexing 10 MB/day, the hot+warm storage would last for almost 10 years - then what's the point of another 30 days of cold (300 MB)? If you index 150GB/day, the hot+warm lasts 2 days, and the cold storage would be almost 5 TB. These two extremes will change the storage needs quite a lot. Normally, you'll have a retention time requirement for data that is online ( hot+warm+cold ) and offline ( frozen ). ... View more