All Apps and Add-ons

Does anyone have example on how to do basic analysis with Splunk & R Project App?

dougdaly
New Member

The R Project app w/ Splunk is intriguing, but though the examples look ok, I'd like an example "Hello World +" script to get going. Does anyone have something like the following:
1. Perform search which has several fields
2. Pipe result into R where a couple fields of the fields are used.
3. Pipe output back to Splunk for visualization based on R analysis and other searched data.

Sounds simple, huh? Really appreciate the example!

Thank you.

Tags (2)
0 Karma

dougdaly
New Member

Here's a simple R-script that worked w/ Splunk. In short, start with a Splunk table, which becomes an R data frame. In my case, I crunched the data as a matrix and converted back to a data frame. Returned the data frame back to Splunk, which is viewed as a Splunk table.

splunk_demo <- function(data_input)
{

define the time factor

Time <- data.frame(as.POSIXct(unique(data_input$X_time),origin = "1970-01-01"))
names(Time) = "Time"

order input data by CLIENT, Time

data_input <- data_input[order(data_input$CLIENT, data_input$X_time),]

define labels based on CLIENT

s <- sort(unique(data_input$CLIENT))

convert input data to matrix for analysis

data_raw <- matrix(data_input$c_ok, ncol=length(s))

apply recursive filter to each input -- define filtered data

scale <- 0.25
data_out <- rbind(data_raw[seq(from=10, to=1, by=-1),],data_raw)
data_out <- filter(data_out* scale, (1-scale), "recursive")

define labels for the filtered data

s_out <- matrix(paste(s,"est",sep="-"),ncol=length(s))

data_out<- data.frame(data_out)
names(data_out) <- s_out

define output table

#raw data has matrix of counts
output <- cbind(Time ,data_out)
return(output)
}

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...