Reporting

How to create aggregated persistent report?

Observer

My web application logs every user action.
Every log entry contains the user id, the action (click, double-click etc...), timestamp and a short description.
The logs for a specific user are stored for a few days,
hence I need to aggregate them to a processed report / data.
I want to collect (and eventually display) a specific action (let's say double click)
of each user and its description.

For example, I want a table that gets updated for every log (or a few logs with some delay),
that aggregates the data of a userId, the timestamp of all of his double clicks, the count of double clicks and the description for each double click.

How can I solve this?
What tools does splunk offer for something like aggregating log streams that gets removed?

0 Karma

Esteemed Legend

The main tool in Splunk for this is summary indexing:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

0 Karma

SplunkTrust
SplunkTrust

Splunk is a tool that aggregates log streams. Forward your web application logs to Splunk and they will stay there until you run out of disk space or they age out (default time is 7 years), even if the original source disappears. Once you have the data in Splunk you can report on it as you've described.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!