logging - 如何将日志聚合到splunk中的持久表？(How to aggregate logs to a persistent table in splunk?)

Question

My web application logs every user action.

(我的Web应用程序记录每个用户操作。)
Every log entry contains the user id, the action (click, double-click etc...), timestamp and a short description.

(每个日志条目都包含用户ID，操作（单击，双击等），时间戳和简短说明。)
The logs for a specific user are stored for a few days, hence I need to aggregate them to a processed report / data.

(特定用户的日志存储了几天，因此我需要将它们聚合到已处理的报告/数据中。)
I want to collect (and eventually display) a specific action (let's say double click) of each user and its description.

(我想收集（并最终显示）每个用户及其描述的特定操作（例如双击）。)

For example, I want a table that gets updated for every log (or a few logs with some delay),

(例如，我想要一个为每个日志（或一些延迟日志）更新的表，)
that aggregates the data of a userId, the timestamp of all of his double clicks, the count of double

(汇总了一个userId的数据，其所有双击的时间戳，double的计数)
clicks and the description for each double click.

(点击次数以及每次双击的说明。)

How can I solve this?

(我该如何解决？)
What tools does splunk offer for something like aggregating log streams that gets removed?

(splunk提供什么工具来处理诸如汇总被删除的日志流之类的事情？)

  ask by natdev translate from so

Answer 1

等待大神答复