×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
devanoverstock
Explorer
Member since: ‎07-05-2022
‎07-08-2022
Community Statistics
Posts 6
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎07-05-2022
Activity Feed
View All

Re: Combine Multiple Data Sources in Pie Chart Vis...

by in Splunk Search
‎07-07-2022 10:38 AM
‎07-07-2022 10:38 AM
Thanks for all the help. I figured it out. I needed to have different time frames for each query as resolutions column is an update column and comes up to 30 days after the headers column. ... View more

Re: Combine Multiple Data Sources in Pie Chart Vis...

by in Splunk Search
‎07-07-2022 08:24 AM
‎07-07-2022 08:24 AM
Thank you! This is getting closer, that still returned 0 results, however I altered it a bit and was able to get PayPal and Credit Card (which is to be expected) the only issue now is it's returning about 10% of the numbers it should be returning. Unsure why. This is how I altered it.    data=headers OR (data=resolutions resolution_name="ACM Chargeback Received - Fraud") | eventstats values(data) AS datasources by tran_id | where isnotnull(mvfind(datasources, "resolutions")) | top payment_method ... View more

Re: Combine Multiple Data Sources in Pie Chart Vis...

by in Splunk Search
‎07-06-2022 07:57 AM
‎07-06-2022 07:57 AM
I used tran_id but unfortunately it brought up no results for the pie chart, it did bring up results in the search but only resolution results.    (data=headers OR data=resolutions) resolution_name="ACM Chargeback Received - Fraud" | eventstats values(data) AS datasources by tran_id | where isnotnull(mvfind(datasources, "resolutions")) | top payment_method ... View more

How to Combine Multiple Data Sources in Pie Chart ...

by in Splunk Search
‎07-05-2022 04:11 PM
‎07-05-2022 04:11 PM
I have a data sources that shows if an order was resolved as fraudulent (data="resolutions")  and in a different data source (data="headers") i have payment_method (Visa, Mastercard, etc)  I want to see a pie chart of only orders that have chargebacks on them by payment method.        data=headers | top payment_method         This works for the pie chart of payment method. I tried:       data=headers OR data=resolutions resolution_name="ACM Chargeback Received - Fraud" | top payment_method         and a few other variations, but I can't seem to get it to work.    Even if I can't do a pie chart and could figure out a table with  Payment Method | Count of Resolution Name (chargeback) that would work ... View more
Labels

Re: How do I use Greater Than in a string

by in Splunk Search
‎07-05-2022 03:23 PM
‎07-05-2022 03:23 PM
That worked perfectly, thank you!!! ... View more

How do I use Greater Than in a string

by in Splunk Search
‎07-05-2022 03:03 PM
‎07-05-2022 03:03 PM
I have a field called rules_tripped It returns the results like this      rules_tripped="5237260000001713515:Item Sku Fraud & Chargeback Percentage 0:0"     Rule ID : Rule Name : Rule Score I want to only search for rules that have a rule score of > 800  Is that possible to split the query and search for only rules with a rule score of > 800? ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎07-08-2022 12:23 AM
Karma given to
View All