Why am I missing fields in search results running the Sentiment Analysis app on Splunk 6.3.3?

[ccsfdave]

Greetings,

I am running Splunk 6.3.3 and trying to get Sentiment Analysis to work with any app. I have a distributed search environment so I put the app on each of my Search Heads and Indexers. I have added local = true to each stanza in my commands.conf file. I have reloaded the deployment server, then bounced Splunk on each server in my environment and cannot find the fields sentiment, language, tokens, or heat. Trying index=twitter or index=*.

What did I miss on the install and config?

Thanks!

[MuS · Accepted solution]

Hi ccsfdave,

I'm using the sentiment app on Splunk 6.4.2 and it works. I index twitter feeds and use

base search here | sentiment twitter text | more Splunk-Fu here

to get the sentiment analysis done on the event field text using the twitter dataset.
The result will have a new field called sentiment, but it looks like you got confused by the commands the app includes and the returned fields. The App will include these commands:

This app includes:

• two trained datasets (twitter and imdv)
• three search commands: sentiment to predict user sentiment language to predict what language an event is written in tokens to make it easier to tokenize terms and phrases for analyzing text heat to measure how emotionally charged a text is Hope this helps ...

cheers, MuS

[ccsfdave]

right you are. Man I feel dumb if that was obvious to everyone but me embarrassed

[aljohnson_splun]

Hey @CCSFDave, the sentiment analysis app hasn't been updated since 6.0, so there are likely a number of things that don't work with newer versions of Splunk.