Splunk search

[s_unny]

HI, i am new to Splunk and trying to gain hands-on experience, i am facing trouble to search the data based on this query "Which age group performed the most fraudulent activities and to what merchant?" can any one help me to figure out the soulution . 

[PickleRick]

1. The question is a bit ambiguous.

2. We don't know your data. Post some (possibly anonymized but I don't think it's necessary in this case).

3. What have you tried so far and how the results differ from what you expected?

[s_unny]

source="sampleprepared_data.csv" fraud="1" | stats count values(fraud) by age,merchant | sort - count

I have tried this query to aggregate the data by age and merchant and sorted the data in descending order, i feel  like something is missing, i can't figure out what

[PickleRick]

Ok. "values(fraud)" will always be 1 because you're only searching for the events which have fraud=1.

As I said before, the question is a bit ambiguous. If you do your (without the values() aggregation which makes no sense.

| stats count by merchant age

it will indeed count your frauds splitting it for each age-merchant pair. But the question is whether you want this - the biggest merchant-age pair or if you want two separate stats one by age and one by merchant and want to find two separate maximum values - one for each stats. The former you already have. The latter you can get by doing two separate searches - one with count by age and onewith count by merchant. Getting both values from a single search will be more complicated.

[s_unny]

I want to print, the age group with the highest fraud activity by a merchant, I found the solution for it, through the query that I mentioned earlier, it appears that the age group 19-35 performed more fraud activities.