topic How to run R script on data from a Splunk search? in Splunk Search

How to run R script on data from a Splunk search?

clongo01 — Mon, 06 Apr 2015 17:24:07 GMT

I wrote a R script that I'd like to run on data from a search in Splunk.
Unfortunately, the only examples of R scripts in Splunk do not use search data. How should I call my search data within the R commands? Currently, it does not recognize the data.

For example, if I wanted to run the script 'myscript.r' on search result data, how would I reference that data from a search in this command?
| r "
source('myscript.r')
result = myscript( data )
output = data.frame(Result=c(result))
"

When I run similar commands on my data I get the error
'command="r", object 'data' not found'

Any suggestions? Thanks!

Re: How to run R script on data from a Splunk search?

rfujara_splunk — Mon, 28 Sep 2020 19:29:24 GMT

The data passed to the R script is accessible thought the "input" variable. The result must be assigned to the "output" variable.

So either pass the script "inline" in quotes like this: | r " temp = some_r_function(input) \n output = another_r_function(temp) "
Or just name the R script (that you need to upload) like this: | r myscript.r

Re: How to run R script on data from a Splunk search?

SanthoshSreshta — Wed, 10 Jun 2015 07:32:34 GMT

Hi @rfujara_splunk, can you please give me info on how to run it on splunk. I am also getting the same error as "No Data" when it is been saved as dashboard. am trying to use chart command. like as

source = "loan_amount.csv" | 
r "
source('cal04.r') 
output=cast()
" | chart output

is it correct form to use.?

Regards,
Santhosh.

Re: How to run R script on data from a Splunk search?

leeyounsoo — Tue, 29 May 2018 07:33:44 GMT

r command is not avail....
splunk is not work... just stop status