Splunk Enterprise

how to 'r' command?

leeyounsoo
Path Finder

hello splunker
i have a question that about R command.

i want peristalsis that R script and Splunk.
so, i installed R and R project app

but 'r' command is Generate error like this : unknown command 'r'.
is need another setting ?

i want know that how to use r command in splunk search and how to setting R project app.

R project document say install R and install openCPU.
but i can't openCPU installed because i can't understand "how to install openCPU" and my production server is disable internet.

must be install openCPU?
can i use R project without openCPU?

my production server enviroment is like this :
- internet is disable (if need, i can request that)
- installed R
- splunk enterprise(search head) and R are installed in one production server

- indexer clustering : indexer 2, search head 1, master 1

  • summary :
  • i want peristalsis that R script and Splunk
  • splunk enterprise(search head) and R are installed in one production server
  • r command is generate error like this : unknown command 'r'. how to use r command.

what should i do?

0 Karma

Azeemering
Builder

You need openCPU because that is what exposes a web API that interfaces R.
OpenCPU will create a new session (and user) for every request it gets.

0 Karma

leeyounsoo
Path Finder

thanks for your answer.
i install opencpu and start server locally.
finally i run basic R script in R project app -> R script editor -> run like this :

========== query =================
index=testindex
| dedup sourcetype
| stats count(sourcetype) as "SOURCETYPE_COUNT"
| append[
search index=testindex
| stats count as "TEST_COUNT"
]
| fillnull value=0

========== R script editor ===========
sum(dataset)

and i got the R console.

=====================================================
add to another question.
- how to send search result into R script ?
- how to save R script function ?
- can i use R script function in another instance search ?
- but i can use r command in instance search ......

thank you.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...