The R Project app w/ Splunk is intriguing, but though the examples look ok, I'd like an example "Hello World +" script to get going. Does anyone have something like the following:
1. Perform search which has several fields
2. Pipe result into R where a couple fields of the fields are used.
3. Pipe output back to Splunk for visualization based on R analysis and other searched data.
Sounds simple, huh? Really appreciate the example!
Thank you.
Here's a simple R-script that worked w/ Splunk. In short, start with a Splunk table, which becomes an R data frame. In my case, I crunched the data as a matrix and converted back to a data frame. Returned the data frame back to Splunk, which is viewed as a Splunk table.
splunk_demo <- function(data_input)
{
Time <- data.frame(as.POSIXct(unique(data_input$X_time),origin = "1970-01-01"))
names(Time) = "Time"
data_input <- data_input[order(data_input$CLIENT, data_input$X_time),]
s <- sort(unique(data_input$CLIENT))
data_raw <- matrix(data_input$c_ok, ncol=length(s))
scale <- 0.25
data_out <- rbind(data_raw[seq(from=10, to=1, by=-1),],data_raw)
data_out <- filter(data_out* scale, (1-scale), "recursive")
s_out <- matrix(paste(s,"est",sep="-"),ncol=length(s))
data_out<- data.frame(data_out)
names(data_out) <- s_out
#raw data has matrix of counts
output <- cbind(Time ,data_out)
return(output)
}