Splunk Machine Learning Toolkit: How do you replace a value of one field with the value of another?

[Jthreadgill]

I checked the past questions and answers, but I was not able to find a way to do this.

Basically the value field of the event is "DERIVE". I need to replace "DERIVE" with the value in Count. I am trying to use Machine Learning Toolkit (MLTK) and I keep getting this error:

"Error while fitting "LinearRegression" model: could not convert string to float: DERIVE"

This was CSV data uploaded.

Thanks for the help.

[somesoni2]

Whats the search query that you're tried? Could you post some sample data/values?

[Jthreadgill]

Thanks, Here is a little more information.

Uploading the csv -
Whitelist
N/A
Blacklist
N/A
Source Type
Automatic
App Context
Splunk_ML_Toolkit
Host

SplunkLab1

The search doesn't seem to change the output, but it is below.

index=REMOVED source="/home/downloads/REMOVED*" | head 100

I select an event and below is what I see for every field and value.
INDISCARDS DERIVE
INERRORS DERIVE

INMULTICASTPKTS DERIVE

If I then select a field I see below.
Values Count %

DERIVE 25 100%

When I try to create a model in MLTK with the same search it then creates the error I provided earlier.

Hope that helps. Thanks,

[Jthreadgill]

The issue is resolved. It was related to corrupted data I was trying to create a 'Fit Model' with. I added one small csv file and now everything is working.