Tim, can you explain to me how you functionally use Insight? I'm realizing, too, that the search results don't even include timestamps! How on earth does one troubleshoot user authentications in a multi-server environment???
(Again, Aruba feel free to chime in with some advice here.)