Splunk Search

R Project: How do I use commands involving paths with R language in Splunk?

dkoops
Path Finder

I want to use R to train a machine learning model, export it using saveRDS(), and then importing it again within Splunk using readRDS().
The problem is, I keep getting errors when trying to specify the path. This happens for any command involving paths; setwd, write.csv, etc.

Errors are similar:

command="r", R exited with code 1: Error: unexpected '/' in: " setwd(/" Execution halted

It probably has to do something with escaping the slashes, but any combination/amount of backslashes results in the same error..

Tags (3)
1 Solution

dkoops
Path Finder

Thanks for taking the time to look into my question, but it seems I figured it out. I was trying to do the following:

| r "
net = readRDS("C:\\User\\Documents\\R\\object.rds")
"

It went wrong with the double quotes within the double quotes; replacing all double quotes used in the R language with single quotes did (part of) the trick. (I should have been able to figure that out quicker, shame on me..)

It resulted in the following error however:

command="r", R exited with code 1: Error: '\U' used without hex digits in character string starting "'C:\U" Execution halted

It seems you also have to escape backslashes thrice for it to work (i'm guessing once for Splunk once for R?) Thus the working code being:

| r "
net = readRDS('C:\\\User\\\Documents\\\R\\\object.rds')
"

View solution in original post

0 Karma

dkoops
Path Finder

Thanks for taking the time to look into my question, but it seems I figured it out. I was trying to do the following:

| r "
net = readRDS("C:\\User\\Documents\\R\\object.rds")
"

It went wrong with the double quotes within the double quotes; replacing all double quotes used in the R language with single quotes did (part of) the trick. (I should have been able to figure that out quicker, shame on me..)

It resulted in the following error however:

command="r", R exited with code 1: Error: '\U' used without hex digits in character string starting "'C:\U" Execution halted

It seems you also have to escape backslashes thrice for it to work (i'm guessing once for Splunk once for R?) Thus the working code being:

| r "
net = readRDS('C:\\\User\\\Documents\\\R\\\object.rds')
"
0 Karma

lguinn2
Legend

Thanks for posting the error, but can you post the command string that generated the error?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...