Archive
Highlighted

Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Path Finder

I am using the R Project with splunk.

My query goes something like

 index= abcd host= pqrs NOT host=aacd NOT host =  ppwqrs | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR)  by  TYPE | r "   data= input 
avg.calls.day <- function(calls){
total.calls <- sum(calls)
out <- total.calls/ndays
return(out)
}
output =  avg.calls.day"

But it keeps throwing me this error

command="r", cannot coerce class ""function"" to a data.frame. 

alt text

Why am i getting this error and how do I resolve it?

0 Karma
Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Influencer

I have to admit that I don't know much R, but with this StackOverflow post it seems like this error is something to do with how you're returning a function as a value?

0 Karma
Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Path Finder

Thanks @acharlieh. While my r code is running just fine in R studio, I am facing issues when I am running it in Splunk with the R Project. My goal is automation,- to run my Rscript in Splunk using the R Project.

0 Karma
Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

SplunkTrust
SplunkTrust

Trying doing your average without going through a function and see how it goes.

Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Path Finder

Hi @DavidHourani, it works if i don't use it as a function. but i really need it to be a function as I use it in all the other calculations.

0 Karma
Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

SplunkTrust
SplunkTrust

Are you able to run any other r-scripts through the command?

0 Karma
Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Path Finder

Hi @muebel , the r -script until this line is running just fine.

0 Karma
Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Path Finder

I don't see where you are applying the function to your input.

I would say, define your function and then

output = avg.calls.day(input)

View solution in original post

Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Path Finder

I made a very simple example that works:

  • |stats count by source |r "simpleFunction <-function(class){ out<-sum(class) return(out)} output <- simpleFunction(input$count)"

I just saw your longer example and I'll look at it.

Highlighted

Re: Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

Path Finder

I am probably missing something but I still don't see where you are using "input". The variable "input" is what r brings in from the Splunk search before the r script. and then "output" is what is returned back to the search.