New to dbs and Splunk.
Querying against a CSV file of buy events. Want to return top 10 Users by purchase totals.
I ran:
source="file_name.csv" | sort by userid | stats sum(price) as BuyerTotals by userId |rename userId as User | sort -num(BuyerTotals) by User limit=10
A sanity check indicates my returned values are correct.
Can anyone suggest a more elegant way of scripting?
Cheers,
James
Hey
Try this !
source="file_name.csv" | stats sum(price) as BuyerTotals by userId |rename userId as User | sort limit=10 BuyerTotals desc
Let me know if this helps you!