That's not too hard.. _time is derived from the timestamp, which could be in the past or in the future(!). _indextime is the time the event arrives at the indexer. ... View more

Hi xiangtaner, It looks like you've already found the right spot. The packages should be installed to /usr/local/lib/R/site-library and this folder cannot be changed (at least not that I've found). The reason for this is security. When users can execute code in R via the API they might install packages that you don't want in your environment. Therefore R will create a new folder for every request to the API and everything the user does is confined to this folder, including installing packages. The easiest way to install packages for all users is: sudo R install.packages(<package_name>, lib = "/usr/local/lib/R/site-library") I will update the documentation with these instructions. This is the link to the OpenCPU documentation (chapter 3.2 deals with installing packages): https://cran.r-project.org/web/packages/opencpu/vignettes/opencpu-server.pdf ... View more

Thanks for using the R app! (and attending our presentation) There are a couple of things you need to take into account: 1. Splunk is not consistent in the order of the columns (even when using table or fields commands). This means that dataset[-5] will not give you a consistent column. We haven't found a workaround yet, however, you can use column names in R. 2. Splunk in not aware of any data types and will always send out strings (even when it's obvious that your data is numeric). Our app will try to parse the data as numeric but when it fails R will receive chars instead of numerics. It's most safe to cast data types in R explicitly. When debugging, you can use the parameter getResults=false which will give you a link to the console output by R. When using the str() command in R the console will show the data types. So back to your query. This example should work (works on my machine): | inputlookup iris.csv | runRdo script=" # Fix the random seed set.seed(1); # Store the dataset in a variable my_iris = dataset; # Seperate the species column from the rest species = as.factor(my_iris$species); my_iris = my_iris[ , !(names(my_iris) %in% c('species'))]; # Cast data types my_iris$petal_length = as.numeric(my_iris$petal_length); my_iris$sepal_length = as.numeric(my_iris$sepal_length); my_iris$petal_width = as.numeric(my_iris$petal_width); my_iris$sepal_width = as.numeric(my_iris$sepal_width); # Show summaries in the console, use getResults=false to see the link to the console str(species); str(my_iris); # Perform the kmeans kmeans_iris = kmeans(my_iris, 3); kmeans_table = table(kmeans_iris$cluster, species); # Return a dataframe return(as.data.frame(kmeans_table));" getResults=t I hope this fixes your issue! We'd love to hear how your using our app so stay in touch! ... View more

Why not use a token directly? timechart span=d max(kpi1) as kpi1 | predict kpi1 as kpi1 future_timespan=$your_timespan$ holdback=1 Just make a text input with the token name your_timespan and you should be good to go... ... View more