topic Re: Splunk search in Splunk Search

Splunk search

s_unny — Sat, 06 Jul 2024 16:39:32 GMT

HI, i am new to Splunk and trying to gain hands-on experience, i am facing trouble to search the data based on this query "Which age group performed the most fraudulent activities and to what merchant?" can any one help me to figure out the soulution .

Re: Splunk search

PickleRick — Sat, 06 Jul 2024 21:34:09 GMT

1. The question is a bit ambiguous.

2. We don't know your data. Post some (possibly anonymized but I don't think it's necessary in this case).

3. What have you tried so far and how the results differ from what you expected?

Re: Splunk search

s_unny — Sat, 06 Jul 2024 17:00:07 GMT

source="sampleprepared_data.csv" fraud="1" | stats count values(fraud) by age,merchant | sort - count

I have tried this query to aggregate the data by age and merchant and sorted the data in descending order, i feel like something is missing, i can't figure out what

Re: Splunk search

PickleRick — Sat, 06 Jul 2024 21:02:12 GMT

Ok. "values(fraud)" will always be 1 because you're only searching for the events which have fraud=1.

As I said before, the question is a bit ambiguous. If you do your (without the values() aggregation which makes no sense.

| stats count by merchant age

it will indeed count your frauds splitting it for each age-merchant pair. But the question is whether you want this - the biggest merchant-age pair or if you want two separate stats one by age and one by merchant and want to find two separate maximum values - one for each stats. The former you already have. The latter you can get by doing two separate searches - one with count by age and onewith count by merchant. Getting both values from a single search will be more complicated.

Re: Splunk search

s_unny — Sat, 06 Jul 2024 21:40:40 GMT

I want to print, the age group with the highest fraud activity by a merchant, I found the solution for it, through the query that I mentioned earlier, it appears that the age group 19-35 performed more fraud activities.