Investigation Run Help and Documentation

Learn how to read a completed Zahlen issuer investigation, interpret its metadata and summary tables, download generated artifacts, filter and sort report data, and understand alert and telemetry results.

Run Page Overview

This page is the durable record of one CSV investigation. The example run is ZN-2026-06-14-0001.

  • Run status and identifying information
  • Input filename and processed row count
  • Primary result and structured findings
  • Downloadable inputs and generated outputs
  • Bank-and-response-code summaries
  • Spike-alert evidence
  • Truth-link and external-code telemetry
Durable investigation recordYou can leave this page and return later through Run History without uploading the same CSV again.

Run Status

completed

Completed means Zahlen finished processing the CSV and saved the run record and available outputs.

Completed does not mean every field contains a valueAn initial-decline file can legitimately show zero recoveries, blank retry fields, no alerts, or no truth matches.

Run Metadata

Job IDThe unique run identifier.
StatusThe lifecycle state of the run.
CreatedThe UTC creation time.
UpdatedThe latest saved update time.
Input FileThe uploaded CSV filename.
RowsThe number of data rows.
Bank ColumnThe CSV field used for issuer grouping.
Rules VersionThe recorded rules version, when available.
Playbook VersionThe recorded playbook version, when available.
App VersionThe build or wiring identifier.
Use StateWhether stateful processing was enabled.
Spike AlertsWhether spike detection was enabled.
AI ModeWhether AI-assisted processing was enabled.
Blank version fieldsA blank Rules Version or Playbook Version means no value was recorded for that run.

Primary Finding

This table highlights the most prominent bank-level result.

BankThe issuer or bank.
EventsThe matching transaction count.
Successful RecoveriesThe events that later recovered.
Recovery RateRecoveries divided by eligible events.
ConfidenceThe reliability band.
Median Days to SuccessThe middle recovery time.
Best Retry DayThe strongest observed retry day.
Why fields can be blankWithout recovery events, Zahlen cannot calculate median recovery time or a best retry day.

Findings

Structured findings appear here when saved by the run. The supplied page states: No structured findings were saved for this run.

This is informationalA run can complete successfully even without structured findings.

Exported Artifacts and Download Buttons

Each artifact has a Download button that downloads the named file for this run.

Protect downloaded dataStore exports only in approved locations and share them according to organizational policy.

Input CSV

The original uploaded file. Use it to confirm the exact source data.

Summary JSON

A structured summary for automation, APIs, or technical review.

Findings JSON

Structured findings; it may contain an empty collection.

Results CSV

Row-level analysis output for detailed inspection.

Summary CSV

Grouped, spreadsheet-friendly summary output.

Alerts CSV

Detected alert rows; it may contain no alert records.

Alerts JSONL

One alert JSON object per line, useful for ingestion and log tools.

Telemetry CSV

Truth-match and external-code telemetry.

Candidate Guidance JSON

Candidate guidance for governed review; it is not an automatic production change.

Job Metadata JSON

The durable run record with identifiers, settings, status, and artifact metadata.

Recommended audit setRetain the Input CSV, Job Metadata JSON, Summary JSON, Findings JSON, Results CSV, and relevant alert or telemetry files.

Summary by Bank and Code

Each row is a grouped issuer cohort rather than a single transaction.

binThe issuer identification number.
countryThe issuer country.
card_brandThe card network or brand.
response_codeThe represented payment response code.
NThe number of events in the group.
N_successThe successful recoveries.
bankThe bank or issuer name.
recovery_rateThe proportion that recovered.
confidenceThe evidence-strength band.
median_days_to_successThe median recovery time.
best_retry_dayThe strongest retry day.
Interpret codes through governed explainabilityCodes such as 51, 54, 91, 5, 14, and 59 should be interpreted through Zahlen's code-catalog features.
Zero recovery rates can be expectedAn initial-decline file can show zero recovery because later outcomes do not yet exist or are not yet linked.

Filtering and Sorting Tables

Filter Table Field

The Filter table... field narrows visible rows as you type. It does not modify saved data.

  1. Select the filter field.
  2. Type a bank, BIN, country, card brand, code, or confidence value.
  3. Review the matching rows.
  4. Delete the text to restore all rows.

Examples: Chase, 414720, US, 51, or HIGH.

Sortable Column Headers

Select a column heading such as N, bank, or confidence to change the display order.

Display-only actionSorting does not change the CSV, database, or saved investigation.

Alert Evidence

This area shows spike alerts or related evidence. The supplied run says: No spike alerts were generated for this run.

No alert is not no dataIt means the enabled alert rules did not identify a qualifying spike. The summaries and telemetry remain available.

Telemetry Summary

Telemetry explains truth matching, confidence, external status, and response-code distribution.

Telemetry Events

The rows represented by the telemetry report.

Truth-Linked Events

Events associated with a truth match or confidence band.

Top Confidence Band

The most common truth confidence. NONE means no truth confidence was assigned.

Top External Status

NOT_RUN means the represented external process did not run.

Response Codes

The count of distinct response-code groups.

No Truth Matches Found Yet

This means telemetry exists, but no truth-linked behavior was found for the run.

Initial-file contextLater retry files or enrichment can supply the evidence needed to link outcomes and calculate recovery behavior.

Telemetry Filter Field

This filter affects only the telemetry table and operates independently from the summary filter.

Telemetry Table Columns

truth_lookup_confidence_bandConfidence assigned during lookup.
truth_confidence_bandThe final truth-confidence classification.
truth_matches_foundThe number or indicator of matches.
truth_matched_byThe match method or key.
external_statusThe external process status.
paymentech_codeThe represented response code.
event_countThe events in the group.
pct_of_eventsThe decimal share of all run events.
Percentage example0.2809 means 28.09 percent of all run events.

Recommended Review Workflow

  1. Confirm the Job ID and Completed status.
  2. Verify the input filename and row count.
  3. Review Bank column, Use State, Spike Alerts, and AI Mode.
  4. Read the Primary Finding.
  5. Review structured Findings.
  6. Filter the Summary table by bank, BIN, country, or response code.
  7. Select column headings to sort the summary.
  8. Review Alert Evidence.
  9. Review Telemetry Summary and information signals.
  10. Filter and sort telemetry when deeper inspection is needed.
  11. Download required artifacts.
  12. Use Run History to return later.
Preserve context when sharing exportsInclude the Job ID and explain whether the source was an initial-decline, retry, or recovery-outcome file.