How to write a query to show the top performer (Single Value)?

[ranjitbrhm1]

Hello All, I want to write something that shows a single value with the below data
Customer M 5 Units
Customer N 15 Units
Customer O 52 Units
Customer P 54 Units
Customer W 522 Units
Customer Q 51 Units

I want to see who is my biggest customer here. Obviously my biggest customer is W. But is there a way where i can show the biggest customer name on my dashboard? Like Biggest customer - "Customer W" I dont need to know any other details, Just the biggest customer name.
Thanks

[niketn · Accepted solution]

@ranjitbrhm1, you can sort Units in descending order and then retain only the first row. Then save the search with Single Value visualization on your dashboard. If you are on Splunk Enterprise 6.6. or higher and want to show top 5 Customers you can retain | head 5 and use Single Value with Trellis Layout to show all 5 customers.

<yourCurrentSearch>
| sort - Units
| head 1

Following is a run anywhere example based on your sample data:

| makeresults
| eval data="Customer=M,Units=5;Customer=N,Units=15;Customer=O,Units=52;Customer=P,Units=54;Customer=W,Units=522;Customer=Q,Units=51"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| table Customer Units
| sort - Units
| head 1

PS: You can also try out Status Indicator Custom Visualization for Similar output as Single Value.