Hello,
We have some BI data from the finance department that we need to import and process monthly in Splunk from a csv file that contains several columns but the most important in this scenario are:
Customer_ID
Withdrawal
Both of these columns have numerical values only. What I am trying to achieve is to get the top 10 customer IDs who withdrew the largest amount of money. To get to this point I need to find every instance of every customer in the month and combine the value in the "Withdrawal" column for that customer, and then display the top 10 customers.
I have no idea where to begin...
Thanks!
Ken
Assuming you follow our docs online and get the data into Splunk with fields for Customer_ID and Withdrawal you would have a search that looks like this:
<your search> | stats sum(Withdrawal) as Total by Customer_ID | sort -Total | head 10
This will give you the totals for each customer, sort it in Descending order and take the first 10 results based on the sort order.