All Apps and Add-ons

Why am I missing fields in search results running the Sentiment Analysis app on Splunk 6.3.3?

ccsfdave
Builder

Greetings,

I am running Splunk 6.3.3 and trying to get Sentiment Analysis to work with any app. I have a distributed search environment so I put the app on each of my Search Heads and Indexers. I have added local = true to each stanza in my commands.conf file. I have reloaded the deployment server, then bounced Splunk on each server in my environment and cannot find the fields sentiment, language, tokens, or heat. Trying index=twitter or index=*.

What did I miss on the install and config?

Thanks!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ccsfdave,

I'm using the sentiment app on Splunk 6.4.2 and it works. I index twitter feeds and use

base search here | sentiment twitter text | more Splunk-Fu here

to get the sentiment analysis done on the event field text using the twitter dataset.
The result will have a new field called sentiment, but it looks like you got confused by the commands the app includes and the returned fields. The App will include these commands:

This app includes:

  • two trained datasets (twitter and imdv)
  • three search commands: sentiment to predict user sentiment language to predict what language an event is written in tokens to make it easier to tokenize terms and phrases for analyzing text heat to measure how emotionally charged a text is Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi ccsfdave,

I'm using the sentiment app on Splunk 6.4.2 and it works. I index twitter feeds and use

base search here | sentiment twitter text | more Splunk-Fu here

to get the sentiment analysis done on the event field text using the twitter dataset.
The result will have a new field called sentiment, but it looks like you got confused by the commands the app includes and the returned fields. The App will include these commands:

This app includes:

  • two trained datasets (twitter and imdv)
  • three search commands: sentiment to predict user sentiment language to predict what language an event is written in tokens to make it easier to tokenize terms and phrases for analyzing text heat to measure how emotionally charged a text is Hope this helps ...

cheers, MuS

ccsfdave
Builder

right you are. Man I feel dumb if that was obvious to everyone but me embarrassed

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Hey @CCSFDave, the sentiment analysis app hasn't been updated since 6.0, so there are likely a number of things that don't work with newer versions of Splunk.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...