All Apps and Add-ons

Why am I missing fields in search results running the Sentiment Analysis app on Splunk 6.3.3?

ccsfdave
Builder

Greetings,

I am running Splunk 6.3.3 and trying to get Sentiment Analysis to work with any app. I have a distributed search environment so I put the app on each of my Search Heads and Indexers. I have added local = true to each stanza in my commands.conf file. I have reloaded the deployment server, then bounced Splunk on each server in my environment and cannot find the fields sentiment, language, tokens, or heat. Trying index=twitter or index=*.

What did I miss on the install and config?

Thanks!

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ccsfdave,

I'm using the sentiment app on Splunk 6.4.2 and it works. I index twitter feeds and use

base search here | sentiment twitter text | more Splunk-Fu here

to get the sentiment analysis done on the event field text using the twitter dataset.
The result will have a new field called sentiment, but it looks like you got confused by the commands the app includes and the returned fields. The App will include these commands:

This app includes:

  • two trained datasets (twitter and imdv)
  • three search commands: sentiment to predict user sentiment language to predict what language an event is written in tokens to make it easier to tokenize terms and phrases for analyzing text heat to measure how emotionally charged a text is Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi ccsfdave,

I'm using the sentiment app on Splunk 6.4.2 and it works. I index twitter feeds and use

base search here | sentiment twitter text | more Splunk-Fu here

to get the sentiment analysis done on the event field text using the twitter dataset.
The result will have a new field called sentiment, but it looks like you got confused by the commands the app includes and the returned fields. The App will include these commands:

This app includes:

  • two trained datasets (twitter and imdv)
  • three search commands: sentiment to predict user sentiment language to predict what language an event is written in tokens to make it easier to tokenize terms and phrases for analyzing text heat to measure how emotionally charged a text is Hope this helps ...

cheers, MuS

ccsfdave
Builder

right you are. Man I feel dumb if that was obvious to everyone but me embarrassed

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Hey @CCSFDave, the sentiment analysis app hasn't been updated since 6.0, so there are likely a number of things that don't work with newer versions of Splunk.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...