Splunk Search

Receiving an error of an unexpect symbol when running a script in R.

krwinters11
Path Finder

This is the error I am receiving:

command="r", R exited with code 1: Error: unexpected symbol in: "input <- read.csv( "c:\windows\temp\tmp2d19tj", check.names=FALSE) source('predictR.r') result" Execution halted

I am never actually calling read.csv in my script. Any suggestions?

Tags (3)
0 Karma
1 Solution

krwinters11
Path Finder

Our problem came from the way we were taking in the variable. They were read in as characters, so in order to fix the problem, we needed to typecast our values back to numeric for R to read them correctly.
We added a line at the beginning of our function to "unlist" and cast to numeric:
y<-as.numeric(unlist(y))

View solution in original post

0 Karma

krwinters11
Path Finder

Our problem came from the way we were taking in the variable. They were read in as characters, so in order to fix the problem, we needed to typecast our values back to numeric for R to read them correctly.
We added a line at the beginning of our function to "unlist" and cast to numeric:
y<-as.numeric(unlist(y))

0 Karma

Patient
Path Finder

Hi krwinters,

I don't know if this will help you, if I have understood very well you need to
Upload a csv file in your script. If yes I wil like to let you know that The command requires one parameters which is either a actual R language script:

  1. | r "output = data.frame(Name=c('A','B','C'),Value=c(1,2,3))"
  2. or just the name of a R script file that is uploaded to the app: | r myscript.r
  3. Now, Input comes in asinput and you need you direct your results to output to get them back into Splunk. For example: | r "exp(mean(log( read.csv(input)))) -> output"
  4. For more information, follow this link: http://stackoverflow.com/questions/26607592/splunk-query-language-for-r
0 Karma

krwinters11
Path Finder

this is my script:
predictR <- function(y){
o <- (sum(y>(100+3*sd(y)) ) + sum(y<(100-3*sd(y)) ))/2+1

fq <- length(y)/o

fit <- stl(ts(y, freq=fq), "per", robust=TRUE)
forecasted.data <- fit$time.series[1:102,1] + mean(y)

fitted.data <- fit$time.series[,2]+fit$time.series[,1]

forecast <- c(fitted.data, forecasted.data)
return(forecast)
}

I never call read...which is why I am confused.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...