topic Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error? in Splunk Search

Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

m_vivek — Fri, 25 Sep 2015 21:40:14 GMT

I am using the R Project with splunk.

My query goes something like

 index= abcd host= pqrs NOT host=aacd NOT host =  ppwqrs | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR)  by  TYPE | r "   data= input 
avg.calls.day <- function(calls){
total.calls <- sum(calls)
out <- total.calls/ndays
return(out)
}
output =  avg.calls.day"

But it keeps throwing me this error

command="r", cannot coerce class ""function"" to a data.frame.

Why am i getting this error and how do I resolve it?

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

acharlieh — Sat, 26 Sep 2015 02:49:15 GMT

I have to admit that I don't know much R, but with this StackOverflow post it seems like this error is something to do with how you're returning a function as a value?

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

m_vivek — Sun, 27 Sep 2015 18:15:46 GMT

Thanks @acharlieh. While my r code is running just fine in R studio, I am facing issues when I am running it in Splunk with the R Project. My goal is automation,- to run my Rscript in Splunk using the R Project.

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

DavidHourani — Mon, 28 Sep 2015 08:07:22 GMT

Trying doing your average without going through a function and see how it goes.

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

muebel — Wed, 30 Sep 2015 02:05:39 GMT

Are you able to run any other r-scripts through the command?

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

m_vivek — Wed, 30 Sep 2015 22:17:01 GMT

Hi @muebel , the r -script until this line is running just fine.

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

walkerhound — Thu, 01 Oct 2015 13:04:12 GMT

I don't see where you are applying the function to your input.

I would say, define your function and then

output = avg.calls.day(input)

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

m_vivek — Thu, 01 Oct 2015 19:03:54 GMT

Hi @DavidHourani, it works if i don't use it as a function. but i really need it to be a function as I use it in all the other calculations.

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

walkerhound — Thu, 01 Oct 2015 21:14:20 GMT

I made a very simple example that works:

|stats count by source |r "simpleFunction <-function(class){ out<-sum(class) return(out)} output <- simpleFunction(input$count)"

I just saw your longer example and I'll look at it.

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

walkerhound — Thu, 01 Oct 2015 21:20:30 GMT

I am probably missing something but I still don't see where you are using "input". The variable "input" is what r brings in from the Splunk search before the r script. and then "output" is what is returned back to the search.