All Apps and Add-ons

Problem with MLTK fit command and map command

splunker2
Engager

Hello!

I have a huge problem with map command, I tried to us an ACF (autocorrelation function) for more than 1 field. The main point is that I can not pass the field name using map command. Let me show you an example:

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "Logging_ERROR" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (NOT WORK)

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "$col$" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (WORK)

The error shown is: Error in 'fit' command: Error while fitting "ACF" model: No valid fields to fit or apply model to.

 

I don't want to write manually using append because I have a lot of them, I just tried to work with 2 fields in order to check if is it working.

Anyone knows what is it happening? Is it an error? Is it possible to solve it?

Labels (4)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...