How to run R script on data from a Splunk search?

[clongo01]

I wrote a R script that I'd like to run on data from a search in Splunk.
Unfortunately, the only examples of R scripts in Splunk do not use search data. How should I call my search data within the R commands? Currently, it does not recognize the data.

For example, if I wanted to run the script 'myscript.r' on search result data, how would I reference that data from a search in this command?
| r "
source('myscript.r')
result = myscript( data )
output = data.frame(Result=c(result))
"

When I run similar commands on my data I get the error
'command="r", object 'data' not found'

Any suggestions? Thanks!

[rfujara_splunk · Accepted solution]

The data passed to the R script is accessible thought the "input" variable. The result must be assigned to the "output" variable.

So either pass the script "inline" in quotes like this: | r " temp = some_r_function(input) \n output = another_r_function(temp) "
Or just name the R script (that you need to upload) like this: | r myscript.r

[SanthoshSreshta]

Hi @rfujara_splunk, can you please give me info on how to run it on splunk. I am also getting the same error as "No Data" when it is been saved as dashboard. am trying to use chart command. like as

source = "loan_amount.csv" | 
r "
source('cal04.r') 
output=cast()
" | chart output

is it correct form to use.?

Regards,
Santhosh.

[leeyounsoo]

r command is not avail....
splunk is not work... just stop status