Does anyone have example on how to do basic analysis with Splunk & R Project App?

[dougdaly]

The R Project app w/ Splunk is intriguing, but though the examples look ok, I'd like an example "Hello World +" script to get going. Does anyone have something like the following:
1. Perform search which has several fields
2. Pipe result into R where a couple fields of the fields are used.
3. Pipe output back to Splunk for visualization based on R analysis and other searched data.

Sounds simple, huh? Really appreciate the example!

Thank you.

[dougdaly]

Here's a simple R-script that worked w/ Splunk. In short, start with a Splunk table, which becomes an R data frame. In my case, I crunched the data as a matrix and converted back to a data frame. Returned the data frame back to Splunk, which is viewed as a Splunk table.

splunk_demo <- function(data_input)
{

define the time factor

Time <- data.frame(as.POSIXct(unique(data_input$X_time),origin = "1970-01-01"))
names(Time) = "Time"

order input data by CLIENT, Time

data_input <- data_input[order(data_input$CLIENT, data_input$X_time),]

define labels based on CLIENT

s <- sort(unique(data_input$CLIENT))

convert input data to matrix for analysis

data_raw <- matrix(data_input$c_ok, ncol=length(s))

apply recursive filter to each input -- define filtered data

scale <- 0.25
data_out <- rbind(data_raw[seq(from=10, to=1, by=-1),],data_raw)
data_out <- filter(data_out* scale, (1-scale), "recursive")

define labels for the filtered data

s_out <- matrix(paste(s,"est",sep="-"),ncol=length(s))

data_out<- data.frame(data_out)
names(data_out) <- s_out

define output table

#raw data has matrix of counts
output <- cbind(Time ,data_out)
return(output)
}