Here's a simple R-script that worked w/ Splunk. In short, start with a Splunk table, which becomes an R data frame. In my case, I crunched the data as a matrix and converted back to a data frame. Returned the data frame back to Splunk, which is viewed as a Splunk table.
splunk_demo <- function(data_input)
{
define the time factor
Time <- data.frame(as.POSIXct(unique(data_input$X_time),origin = "1970-01-01"))
names(Time) = "Time"
order input data by CLIENT, Time
data_input <- data_input[order(data_input$CLIENT, data_input$X_time),]
define labels based on CLIENT
s <- sort(unique(data_input$CLIENT))
convert input data to matrix for analysis
data_raw <- matrix(data_input$c_ok, ncol=length(s))
apply recursive filter to each input -- define filtered data
scale <- 0.25
data_out <- rbind(data_raw[seq(from=10, to=1, by=-1),],data_raw)
data_out <- filter(data_out* scale, (1-scale), "recursive")
define labels for the filtered data
s_out <- matrix(paste(s,"est",sep="-"),ncol=length(s))
data_out<- data.frame(data_out)
names(data_out) <- s_out
define output table
#raw data has matrix of counts
output <- cbind(Time ,data_out)
return(output)
}
... View more
