Splunk Search

Why is R in Splunk giving me a ' trying to coerce a function to a dataframe' error?

m_vivek
Path Finder

I am using the R Project with splunk.

My query goes something like

 index= abcd host= pqrs NOT host=aacd NOT host =  ppwqrs | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR)  by  TYPE | r "   data= input 
avg.calls.day <- function(calls){
total.calls <- sum(calls)
out <- total.calls/ndays
return(out)
}
output =  avg.calls.day"

But it keeps throwing me this error

command="r", cannot coerce class ""function"" to a data.frame. 

alt text

Why am i getting this error and how do I resolve it?

0 Karma
1 Solution

walkerhound
Path Finder

I don't see where you are applying the function to your input.

I would say, define your function and then

output = avg.calls.day(input)

View solution in original post

walkerhound
Path Finder

I don't see where you are applying the function to your input.

I would say, define your function and then

output = avg.calls.day(input)

walkerhound
Path Finder

I am probably missing something but I still don't see where you are using "input". The variable "input" is what r brings in from the Splunk search before the r script. and then "output" is what is returned back to the search.

walkerhound
Path Finder

I made a very simple example that works:

  • |stats count by source |r "simpleFunction <-function(class){ out<-sum(class) return(out)} output <- simpleFunction(input$count)"

I just saw your longer example and I'll look at it.

muebel
SplunkTrust
SplunkTrust

Are you able to run any other r-scripts through the command?

0 Karma

m_vivek
Path Finder

Hi @muebel , the r -script until this line is running just fine.

0 Karma

DavidHourani
Super Champion

Trying doing your average without going through a function and see how it goes.

m_vivek
Path Finder

Hi @DavidHourani, it works if i don't use it as a function. but i really need it to be a function as I use it in all the other calculations.

0 Karma

acharlieh
Influencer

I have to admit that I don't know much R, but with this StackOverflow post it seems like this error is something to do with how you're returning a function as a value?

0 Karma

m_vivek
Path Finder

Thanks @acharlieh. While my r code is running just fine in R studio, I am facing issues when I am running it in Splunk with the R Project. My goal is automation,- to run my Rscript in Splunk using the R Project.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...