Integrate Splunk Machine Learning Toolkit with Splunk Edge Hub

You can integrate a Splunk Machine Learning Toolkit (MLTK) model with the Splunk Edge Hub device using the Splunk App for Edge Hub and AR.

The Splunk App for Edge Hub and AR supports the MLTK Smart Outlier Detection model. After you integrate this model with your Splunk Edge Hub device, a sensor panel turns red to indicate an anomaly detection.

Limitations

MLTK integration with the Splunk Edge Hub has the following limitations:

• Only the Smart Outlier Detection model is currently supported.
• MLTK errors logged on the Splunk Edge Hub device are not sent to your Splunk platform instance.
• MLTK models can only be deployed to internal sensors and external sensors configured with Message Queuing Telemetry Transport (MQTT) protocol. External sensors configured with OPC Unified Architecture (OPC-UA) protocol are not supported.
• Only one model per sensor is currently supported.
• Running multiple MLTK models can impact performance. Performance might degrade when running models on more than two sensors at a time.

Requirements and prerequisites

This feature requires the Splunk App for Edge Hub and AR version 4.8.0 or higher and Splunk Edge Hub version 2.0 or higher.

Complete the following before integrating a MLTK model with your Splunk Edge Hub:

• Complete the steps at Installation and configuration overview for Splunk Edge Hub OS.
• Get started with MLTK. See About the Splunk Machine Learning Toolkit.

Deploy a MLTK model to a Splunk Edge Hub device

Here's how to deploy a MLTK model to a Splunk Edge Hub device:

1. In the MLTK app, configure the model to pull data from your Splunk Edge Hub, complete the Define Outliers fields, and publish the model to the Splunk App for Edge Hub and AR. See Smart Outlier Detection Assistant in the Splunk Machine Learning Toolkit User Guide to learn more about how to use this model.
2. In the Splunk App for Edge Hub and AR, navigate to the Models page.
3. Select Apply model and choose the device and sensors you want to apply the model to.

You can also navigate to Devices or Device Profiles to choose a MLTK model:

1. Navigate to Devices or Settings then Device Profiles
2. Select a Splunk Edge Hub device.
3. Select Open details to select a sensor.
4. Select Running model to choose a model.

On the Splunk Edge Hub device, a MLTK icon appears on the sensors you applied the model to. When an anomaly is detected according to the model you configured, the sensor panel turns red.