Install or upgrade the Splunk App for Data Science and Deep Learning

The Splunk App for Data Science and Deep Learning integrates advanced custom machine learning and deep learning systems with the Splunk platform. Use the following directions to install or upgrade the Splunk App for Data Science and Deep Learning.

Version dependencies

The Splunk App for Data Science and Deep Learning (DSDL) relies on the Splunk Machine Learning Toolkit (MLTK) app. See the following table to ensure you are running compatible versions of the apps:

DSDL version	MLTK app version	PSC add-on version	Python version	Splunk platform version
5.1.1	5.4.0 or higher	3.1.0, 4.1.0, or 4.1.2	3	Splunk Enterprise 8.1.x, 8.2.x, 9.0.0, 9.0.1, or 9.1.0 or Splunk Cloud Platform
5.1.0	5.4.0	3.1.0, 4.1.0, or 4.1.2	3	Splunk Enterprise 8.1.x, 8.2.x, 9.0.0, or 9.0.1 or Splunk Cloud Platform
5.0.0	5.4.0	3.1.0 or 4.1.0	3	Splunk Enterprise 8.1.x, 8.2.x, 9.0.0, or 9.0.1 or Splunk Cloud Platform
5.0.0	5.3.3	3.0.2, 3.1.0, 4.0.0, or 4.1.0	3	Splunk Enterprise 8.1.x, 8.2.x, or 9.0.0 or Splunk Cloud Platform
5.0.0	5.3.1	3.0.0, 3.0.1, or 3.0.2	3	Splunk Enterprise 8.0.x, 8.1.x, 8.2.x, or 9.0.0 or Splunk Cloud Platform
5.0.0	5.3.0	3.0.0, 3.0.1, or 3.0.2	3	Splunk Enterprise 8.0.x, 8.1.x, 8.2.x, or 9.0.0 or Splunk Cloud Platform
5.0.0	5.2.2	2.0.0, 2.0.1, or 2.0.2	3	Splunk Enterprise 8.0.x, 8.1.x, or 8.2.0 or Splunk Cloud Platform
5.0.0	5.2.1	2.0.0, 2.0.1, or 2.0.2	3	Splunk Enterprise 8.0.x, 8.1.x, or 8.2.0 or Splunk Cloud Platform
5.0.0	5.2.0	2.0.0, 2.0.1, or 2.0.2	3	Splunk Enterprise 8.0.x, 8.1.x, or 8.2.0 or Splunk Cloud Platform
5.0.0	5.1.0	2.0.0, 2.0.1, or 2.0.2	3	Splunk Enterprise 8.0.x or 8.1.x or Splunk Cloud Platform
5.0.0	5.0.0	2.0.0, 2.0.1, or 2.0.2	3	Splunk Enterprise 8.0.x or 8.1.x or Splunk Cloud Platform

Where to install the Splunk App for Data Science and Deep Learning

The Splunk App for Data Science and Deep Learning works both on-premises and on Splunk Cloud Platform. You must provide additional security and configurations such as IP address and port allow listing through ACS for Splunk Cloud Platform. For distributed Splunk Enterprise deployments, install DSDL on the search head or search head cluster. You don't need to install DSDL on indexers.

The two typical scenarios for setting up DSDL are single-instance and side-by-side:

• Single-instance runs the containers on the same instance as the Splunk search head. This setup is useful for local development purposes or for small to medium sized production environments.
• Side-by-side is typically used for production environments where the search head connects to a dedicated Kubernetes cluster or dedicated Docker host.

Install the Splunk App for Data Science and Deep Learning

App installation includes some pre-requisites and installation steps.

Prerequisites

You must complete the following prerequisites to successfully run the Splunk App for Data Science and Deep Learning:

• Splunk Enterprise 8.1.x or higher, or Splunk Cloud Platform.
• Install the Splunk Machine Learning Toolkit (MLTK) app.
• Set the Machine Learning Toolkit app permissions to Global so that knowledge objects are shared.
• Install the Python for Scientific Computing (PSC) add-on.
• A Docker, Kubernetes, or OpenShift environment.
  • An internet connection is required to pull the prebuilt Docker container images from the public Docker hub repository.
  • If you use Docker in an air-gapped environment, see Configure the Splunk App for Data Science and Deep Learning.

Steps

Follow these steps to install the Splunk App for Data Science and Deep Learning:

1. Download and install the Splunk App for Data Science and Deep Learning from Splunkbase.
2. Install the Splunk App for Data Science and Deep Learning from the Manage Apps tab. In Splunk Web, select the Manage Apps icon next to Apps in the left navigation bar.
3. On the Apps page, select Install app from file.
4. Select Choose File to navigate to and select the package file for the Splunk App for Data Science and Deep Learning. Then click Open.
5. Select Upload.
6. Restart your Splunk instance after installing the Splunk App for Data Science and Deep Learning.
7. Ensure your internet connected Docker, Kubernetes, or Openshift environment is accessible with permissions to pull the prebuilt MLTK container images and start containers.
8. Set up the Splunk App for Data Science and Deep Learning by connecting it to your environment using the Configuration > Setup page of the app.
9. Test the connection and save the configuration.
10. Start a development container from the Containers tab of the app.

    Data is sent from a Splunk search head to containers using HTTPS for the endpoint URL. A self-signed certificate is provided with the app which works with the prebuilt images. For further security requirements talk to your system administrators about the set up of the app and your Docker, Kubernetes, or OpenShift environment.

11. Depending on your selected image (Golden Image CPU or GPU), run one of the following examples from the Examples tab to verify that the Splunk App for Data Science and Deep Learning is working:
    • Neural Network Classifier Example for Tensorflow
    • Logistic Regression Classifier Example for PyTorch

Upgrade the Splunk App for Data Science and Deep Learning

The Splunk App for Data Science and Deep Learning (DSDL) regularly releases new features and enhancements. To learn about features and enhancements by released version, see New features for the Splunk App for Data Science and Deep Learning in the Release Notes manual.

Upgrade requirements

Running version 5.1.1 of DSDL requires Splunk Enterprise 8.1.x or higher, or Splunk Cloud Platform.

You must also be running version 5.4.0 or higher of the Splunk Machine Learning Toolkit (MLTK), and version 3.1.0, 4.1.0, or 4.1.2 of the Python for Scientific Computing (PSC) add-on.

Update the app in Splunk Web

In Splunk Web, an Update option shows on the app icon in the left-hand Apps menu when a new version of an app is available on Splunkbase. Click that Update option to initiate the app update process.

Alternatively, you can perform the following steps:

1. Download the latest version of the app from Splunkbase.
2. In Splunk Web, click on the gear icon next to Apps in the left navigation bar.
3. On the Apps page, click Install app from file.
4. Click Choose File, navigate to and select the package file for the app or add-on, then click Open.
5. Check the Upgrade app box.
6. Click Upload.
7. (Optional) Run the Configuration > Setup of the app to make sure all container configuration is still valid and that new configuration items are reflected after the app upgrade installation.