Counting aggregated data

kengilmour — Mon, 12 Nov 2012 17:04:59 GMT

Hello,

We have some BI data from the finance department that we need to import and process monthly in Splunk from a csv file that contains several columns but the most important in this scenario are:

Customer_ID
Withdrawal

Both of these columns have numerical values only. What I am trying to achieve is to get the top 10 customer IDs who withdrew the largest amount of money. To get to this point I need to find every instance of every customer in the month and combine the value in the "Withdrawal" column for that customer, and then display the top 10 customers.

I have no idea where to begin...

Thanks!

Ken

Re: Counting aggregated data

sdaniels — Mon, 12 Nov 2012 17:48:17 GMT

Assuming you follow our docs online and get the data into Splunk with fields for Customer_ID and Withdrawal you would have a search that looks like this:

<your search> | stats sum(Withdrawal) as Total by Customer_ID | sort -Total | head 10

This will give you the totals for each customer, sort it in Descending order and take the first 10 results based on the sort order.

topic Re: Counting aggregated data in Splunk Search

Counting aggregated data

Re: Counting aggregated data