SELECT user_id, COUNT(*) as access_count, SUM(CAST(json_extract(details, "$.data_size") AS INTEGER)) as total_data FROM audit_logs WHERE event_type = "data_access" AND created_at > datetime("now", "-${time_window} minutes") GROUP BY user_id