Splunk Search

Receiving an error of an unexpect symbol when running a script in R.

krwinters11
Path Finder

This is the error I am receiving:

command="r", R exited with code 1: Error: unexpected symbol in: "input <- read.csv( "c:\windows\temp\tmp2d19tj", check.names=FALSE) source('predictR.r') result" Execution halted

I am never actually calling read.csv in my script. Any suggestions?

Tags (3)
0 Karma
1 Solution

krwinters11
Path Finder

Our problem came from the way we were taking in the variable. They were read in as characters, so in order to fix the problem, we needed to typecast our values back to numeric for R to read them correctly.
We added a line at the beginning of our function to "unlist" and cast to numeric:
y<-as.numeric(unlist(y))

View solution in original post

0 Karma

krwinters11
Path Finder

Our problem came from the way we were taking in the variable. They were read in as characters, so in order to fix the problem, we needed to typecast our values back to numeric for R to read them correctly.
We added a line at the beginning of our function to "unlist" and cast to numeric:
y<-as.numeric(unlist(y))

0 Karma

Patient
Path Finder

Hi krwinters,

I don't know if this will help you, if I have understood very well you need to
Upload a csv file in your script. If yes I wil like to let you know that The command requires one parameters which is either a actual R language script:

  1. | r "output = data.frame(Name=c('A','B','C'),Value=c(1,2,3))"
  2. or just the name of a R script file that is uploaded to the app: | r myscript.r
  3. Now, Input comes in asinput and you need you direct your results to output to get them back into Splunk. For example: | r "exp(mean(log( read.csv(input)))) -> output"
  4. For more information, follow this link: http://stackoverflow.com/questions/26607592/splunk-query-language-for-r
0 Karma

krwinters11
Path Finder

this is my script:
predictR <- function(y){
o <- (sum(y>(100+3*sd(y)) ) + sum(y<(100-3*sd(y)) ))/2+1

fq <- length(y)/o

fit <- stl(ts(y, freq=fq), "per", robust=TRUE)
forecasted.data <- fit$time.series[1:102,1] + mean(y)

fitted.data <- fit$time.series[,2]+fit$time.series[,1]

forecast <- c(fitted.data, forecasted.data)
return(forecast)
}

I never call read...which is why I am confused.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...