Splunk Search

Simple example of passing Splunk search results to an R script and displaying the results?

jburman123
Explorer

The example provided by SPLUNK for an R script uses the addr.r script that does not use SPLUNK search results. Can you provide a very simple example of a R script that ingests SPLUNK search results and passes them to the script and displays the result?

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I used Splunk search to feed FFT here: http://answers.splunk.com/answer_link/149675/.

A really basic test to understand input from Splunk is to run

| r "output=input"

input is a data frame composed of your search results as well as some Splunk implicit fields. (Data frame is the biggest revelation to me, thanks to @rfujara_splunk.) All fields are prefixed with "X". For example, X_time is Splunk _time, X_span is Splunk _span if you used timechart or bucket; if your search outputs a field host, R sees it as Xhost.

output is the data frame to send back to Splunk. Each component name is used as a field name by Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...