Splunk Search

Counting aggregated data

kengilmour
Path Finder

Hello,

We have some BI data from the finance department that we need to import and process monthly in Splunk from a csv file that contains several columns but the most important in this scenario are:

Customer_ID
Withdrawal

Both of these columns have numerical values only. What I am trying to achieve is to get the top 10 customer IDs who withdrew the largest amount of money. To get to this point I need to find every instance of every customer in the month and combine the value in the "Withdrawal" column for that customer, and then display the top 10 customers.

I have no idea where to begin...

Thanks!

Ken

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Assuming you follow our docs online and get the data into Splunk with fields for Customer_ID and Withdrawal you would have a search that looks like this:

<your search> | stats sum(Withdrawal) as Total by Customer_ID | sort -Total | head 10

This will give you the totals for each customer, sort it in Descending order and take the first 10 results based on the sort order.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...