How to pass search results to an R function?

[SHR]

Hi, I unsuccessfully tried the following approach:

sourcesystem=ABCD earliest=1313131313 latest=1313161616 | r "
source=('modlog.r')
output=modlog(input)
"

with the uploaded script 'modlog.r':

mod_log <- function(a){
p=a$ThreadID+1000
return(p)
}

The field ThreadID is just a number, changing to "p=as.numeric(a$ThreadID)+1000" leads to the same error.

The error I get is basically: command="r", could not find function "modlog".
However, if I upload other functions that don't use "input" as an argument then these are found.

The complete error text: command="r", konnte Funktion "modlog" nicht finden: Traceback (most recent call last): File "D:\Splunk\etc\apps\r\bin\r.py", line 186, in main fieldnames=fieldnames) File "D:\Splunk\etc\apps\r\bin\r.py", line 96, in r scripts.get_custom_scripts_path(), File "D:\Splunk\etc\apps\r\bin\framework.py", line 74, in exeute raise RError('%s' % err) RError: konnte Funktion "modlog" nicht finden

Can anybody see where I made a mistake?

[krwinters11]

Along with @rfujara_splunk's answer, you need to edit your output line. It should be this:
output=mod_log(input)
Or like this:
output=data.frame(mod_log(input))

so, all together:
| r "
source('modlog.r') 
output = data.frame(mod_log(input))
"

[rfujara_splunk]

I think this is an syntax error. Just try to change the line:

source=('modlog.r')

to this:

source('modlog.r')

Does that work?