Splunk® Data Stream Processor

Function Reference

DSP 1.2.0 is impacted by the CVE-2021-44228 and CVE-2021-45046 security vulnerabilities from Apache Log4j. To fix these vulnerabilities, you must upgrade to DSP 1.2.4. See Upgrade the Splunk Data Stream Processor to 1.2.4 for upgrade instructions.

On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor. For documentation on the most recent version, go to the latest release.

Apply ML Model (beta)

Use the Apply ML Model function to see how your model performs in the . The Apply ML Model function retrieves a SMLE Labs trained model from S3 that can be used on data in your pipeline.

Double check that the required fields from your model are present in the incoming stream, and that the data type matches. If the fields or data types do not match, you will see error messages.

Syntax

apply_model
path=<string>
name=<string>
connection_id=<string>;

How to use Apply ML Model

Use the following steps for the Apply ML Model function:

  1. Add Apply ML Model from the function picker to your pipeline.
  2. In the connection_id field, create a connection to save your S3 credentials if you haven't done so already.

    Users with the related S3 credentials should also have read permissions to the S3 bucket.

  3. Once you have a connection created, select the connection.
  4. Fill in the model name on the name field. It should be the name of the model without any suffix.
    Example: iris_model
  5. Fill in the s3 path on the path field. It should be a path-style URL to the bucket where the model is located. Example: s3://my-s3-buckets/models
Last modified on 26 January, 2021
Apply Line Break   Apply Timestamp Extraction

This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters