All Apps and Add-ons

Problem with MLTK fit command and map command

splunker2
Engager

Hello!

I have a huge problem with map command, I tried to us an ACF (autocorrelation function) for more than 1 field. The main point is that I can not pass the field name using map command. Let me show you an example:

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "Logging_ERROR" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (NOT WORK)

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "$col$" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (WORK)

The error shown is: Error in 'fit' command: Error while fitting "ACF" model: No valid fields to fit or apply model to.

 

I don't want to write manually using append because I have a lot of them, I just tried to work with 2 fields in order to check if is it working.

Anyone knows what is it happening? Is it an error? Is it possible to solve it?

Labels (4)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...