topic Re: How do i use R (open source package) in splunk? in Splunk Search

How do i use R (open source package) in splunk?

lsh — Fri, 20 Jul 2012 02:57:19 GMT

How do i use R (open source package) in splunk?

Re: How do i use R (open source package) in splunk?

gkanapathy — Fri, 20 Jul 2012 05:37:05 GMT

You probably have to more specific than this.

Re: How do i use R (open source package) in splunk?

lguinn2 — Fri, 20 Jul 2012 07:13:16 GMT

You can't use a programming language to manipulate Splunk data directly. However, you could use the Splunk API to run searches and then retrieve the results.

Correction: you don't have to write R code that calls the Splunk API, although that is probably one way to go.

Others have pointed out a variety of ways that I didn't consider, such as writing custom commands.

Someday I am gonna learn never to say "you can't do that."

Re: How do i use R (open source package) in splunk?

dwaddle — Fri, 20 Jul 2012 14:26:24 GMT

I think you need to define your goals much more precisely, but lguinn is on the right track. Making the general request of "How do I use X with Y?" when both X and Y have a myriad of possible uses is difficult to answer. As an example, "How do I use flour with eggs?" Well, are you wanting to make a cake, some bread, a batter, pie crust, pancakes, waffles, or what?

Let's assume you have some R code that you wish to run against data stored in Splunk. Depending on how you want to "integrate" the two, this could mean one of (at least) two paths.

You could use R programs as custom search commands in Splunk. There would be some effort here to bridge the gap between Splunk's supported Python/Perl search command interfaces and your R code. But, it's a bridgeable gap. Your R program would receive (essentially) csv on input, do whatever it is you want it to do, and emit csv on output. The Splunkweb GUI would still be present, and your commands written using R could be intermixed with existing Splunk search operations. These results of these could be placed on dashboard panels, used in alerts, etc...
You could make a standalone R program that uses Splunk data via an existing Splunk API. A quick (10 minute) reading of the R documentation and a googling on "R REST" shows that R has some API's already for accessing remote REST endpoints and interpreting XML coming back from them. This may give you a leaping-off point to writing a Splunk SDK for R - but it would be a nontrivial task. This would be using Splunk almost exclusively as a datastore - you would need to provide your own visualizations and user interface.

Re: How do i use R (open source package) in splunk?

Damien_Dallimor — Sat, 21 Jul 2012 00:35:18 GMT

You can potentially use Java or Python bindings for R to utilize the Splunk SDK's.

http://splunk-base.splunk.com/answers/49583/r-language-support

Re: How do i use R (open source package) in splunk?

dbryan — Tue, 24 Jul 2012 04:56:48 GMT

Actually, Splunk supports both Python and Perl for full scriptable control of data on the search pipeline:

http://docs.splunk.com/Documentation/Splunk/latest/developer/searchscripts

There's also the less robust script command in the search API that can be used to call a script.

Re: How do i use R (open source package) in splunk?

halr9000 — Wed, 25 Jul 2012 12:33:55 GMT

Saw this several weeks back, neat R sample idea that could be pertinent. http://flowingdata.com/2010/01/21/how-to-make-a-heatmap-a-quick-and-easy-solution/

Re: How do i use R (open source package) in splunk?

charris_splunk — Tue, 11 Mar 2014 19:34:34 GMT

Check out: http://apps.splunk.com/app/1735/

Re: How do i use R (open source package) in splunk?

hovu96-deactiva — Wed, 12 Mar 2014 22:32:27 GMT

I've created an Splunk R app. It's really in a very early status so don't use it in production environment.

Description from http://apps.splunk.com/app/1735/:

This app provides a new Splunk search
language command 'r' that allows
passing data from Splunk to the
R-Engine for calculation and then
passing results back to Splunk for
further computation or visualization.

The app is open source: https://github.com/rfsp/r.

Please feel free to contribute. Please provide feedback, questions and suggestions!