Counting aggregated data

[kengilmour]

Hello,

We have some BI data from the finance department that we need to import and process monthly in Splunk from a csv file that contains several columns but the most important in this scenario are:

Customer_ID
Withdrawal

Both of these columns have numerical values only. What I am trying to achieve is to get the top 10 customer IDs who withdrew the largest amount of money. To get to this point I need to find every instance of every customer in the month and combine the value in the "Withdrawal" column for that customer, and then display the top 10 customers.

I have no idea where to begin...

Thanks!

Ken

[sdaniels]

Assuming you follow our docs online and get the data into Splunk with fields for Customer_ID and Withdrawal you would have a search that looks like this:

<your search> | stats sum(Withdrawal) as Total by Customer_ID | sort -Total | head 10

This will give you the totals for each customer, sort it in Descending order and take the first 10 results based on the sort order.