All Apps and Add-ons

Problem with MLTK fit command and map command

splunker2
Engager

Hello!

I have a huge problem with map command, I tried to us an ACF (autocorrelation function) for more than 1 field. The main point is that I can not pass the field name using map command. Let me show you an example:

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "Logging_ERROR" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (NOT WORK)

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "$col$" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (WORK)

The error shown is: Error in 'fit' command: Error while fitting "ACF" model: No valid fields to fit or apply model to.

 

I don't want to write manually using append because I have a lot of them, I just tried to work with 2 fields in order to check if is it working.

Anyone knows what is it happening? Is it an error? Is it possible to solve it?

Labels (3)
Tags (3)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...