How to create aggregated persistent report?

[natvaldev]

My web application logs every user action.
Every log entry contains the user id, the action (click, double-click etc...), timestamp and a short description.
The logs for a specific user are stored for a few days,
hence I need to aggregate them to a processed report / data.
I want to collect (and eventually display) a specific action (let's say double click)
of each user and its description.

For example, I want a table that gets updated for every log (or a few logs with some delay),
that aggregates the data of a userId, the timestamp of all of his double clicks, the count of double clicks and the description for each double click.

How can I solve this?
What tools does splunk offer for something like aggregating log streams that gets removed?

[woodcock]

The main tool in Splunk for this is summary indexing:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

[richgalloway]

Splunk is a tool that aggregates log streams. Forward your web application logs to Splunk and they will stay there until you run out of disk space or they age out (default time is 7 years), even if the original source disappears. Once you have the data in Splunk you can report on it as you've described.