A method, performed by one or more processors, the method comprising: in an indexing and searching system comprising one or more indexing nodes and a plurality of search nodes, each of the search nodes having a hot storage system associated therewith, the one or more indexing nodes and the plurality of search nodes being separate and operating independently of one another: receiving (5.1) a stream of log data from one or more applications; indexing (5.2), by the one or more indexing nodes, a plurality of different portions of the received stream to respective locations of a cold storage system; storing (5.3) in an index catalog pointers to the respective locations of the indexed portions in the cold storage system; receiving (5.4), by a search coordinator module, one or more log data requests for indexed log data, the one or more log data requests being derived from a search request from one or more users received through an associated aggregator node; subsequently identifying (5.5), by the search coordinator module, from the index catalog one or more pointers to respective indexed portions of the log data in the cold storage system relevant to at least part of the one or more log data requests; fetching, by the search coordinator module, said indexed portions from the cold storage system; sending (5.6), by the search coordinator module, of the identified one or more indexed portions to be stored at at least one hot storage system associated with the plurality of search nodes for processing of the received search request using the stored indexed portions; receiving, by the aggregator node, a new search request for indexed log data; determining, by the aggregator node that learns from the search coordinator module which of the plurality of search nodes currently serve indexed portions of the log data that may process the new search request based on the indexed portions relevant to the new search request being stored at the hot storage system associated with the first search node; based on the determination, forwarding by the aggregator node, the new search request to the first search node for processing the new search request using their respective associated hot storage systems; processing the search query by the search nodes on respective associated hot storage systems storing the indexed portions of the log data; aggregating, by the aggregator node, search results from the search nodes and displaying the search results. receiving (5.1) a stream of log data from one or more applications; indexing (5.2), by the one or more indexing nodes, a plurality of different portions of the received stream to respective locations of a cold storage system; storing (5.3) in an index catalog pointers to the respective locations of the indexed portions in the cold storage system; receiving (5.4), by a search coordinator module, one or more log data requests for indexed log data, the one or more log data requests being derived from a search request from one or more users received through an associated aggregator node; subsequently identifying (5.5), by the search coordinator module, from the index catalog one or more pointers to respective indexed portions of the log data in the cold storage system relevant to at least part of the one or more log data requests; fetching, by the search coordinator module, said indexed portions from the cold storage system; sending (5.6), by the search coordinator module, of the identified one or more indexed portions to be stored at at least one hot storage system associated with the plurality of search nodes for processing of the received search request using the stored indexed portions; receiving, by the aggregator node, a new search request for indexed log data; determining, by the aggregator node that learns from the search coordinator module which of the plurality of search nodes currently serve indexed portions of the log data that may process the new search request based on the indexed portions relevant to the new search request being stored at the hot storage system associated with the first search node; based on the determination, forwarding by the aggregator node, the new search request to the first search node for processing the new search request using their respective associated hot storage systems; processing the search query by the search nodes on respective associated hot storage systems storing the indexed portions of the log data; aggregating, by the aggregator node, search results from the search nodes and displaying the search results.