All Apps and Add-ons

Problem with MLTK fit command and map command

splunker2
Engager

Hello!

I have a huge problem with map command, I tried to us an ACF (autocorrelation function) for more than 1 field. The main point is that I can not pass the field name using map command. Let me show you an example:

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "Logging_ERROR" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (NOT WORK)

source="datos.csv"
| table Logging_ERROR, User_ERROR | transpose | table column | rename column as col | map [search source="datos.csv" |table "$col$" | fit ACF "$col$" k=1440 fft=false conf_interval=90 ] maxsearches=2000000 (WORK)

The error shown is: Error in 'fit' command: Error while fitting "ACF" model: No valid fields to fit or apply model to.

 

I don't want to write manually using append because I have a lot of them, I just tried to work with 2 fields in order to check if is it working.

Anyone knows what is it happening? Is it an error? Is it possible to solve it?

Labels (3)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...