Splunk Search

Counting aggregated data

Path Finder


We have some BI data from the finance department that we need to import and process monthly in Splunk from a csv file that contains several columns but the most important in this scenario are:


Both of these columns have numerical values only. What I am trying to achieve is to get the top 10 customer IDs who withdrew the largest amount of money. To get to this point I need to find every instance of every customer in the month and combine the value in the "Withdrawal" column for that customer, and then display the top 10 customers.

I have no idea where to begin...



Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Assuming you follow our docs online and get the data into Splunk with fields for Customer_ID and Withdrawal you would have a search that looks like this:

<your search> | stats sum(Withdrawal) as Total by Customer_ID | sort -Total | head 10

This will give you the totals for each customer, sort it in Descending order and take the first 10 results based on the sort order.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...