Splunk® Machine Learning Toolkit

User Guide

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Machine Learning Toolkit. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Custom visualizations

The Splunk Machine Learning Toolkit includes several reusable custom visualizations that you can use in your own dashboards. Each visualization expects data in a certain format with certain fields, that you can see in the syntax portion of the visualization descriptions.

To apply a custom visualization to your data:

  1. Run a search from the Search page in the Splunk Machine Learning Toolkit or the default Search & Reporting app on the Splunk platform.

  2. Click the Visualization tab, then click the menu at the top left to display available visualizations.

    This image shows the Search page of the Machine Learning Toolkit. Four tabs are available to view on this page including Events, Patterns, Statistics and Visualization. The Visualization tab is selected and the Format button clicked. Within the format options, are several visualizations to choose from. In this example, the Scatter Line Chart is selected.
  3. Select a visualization.

You can use these custom visualizations on any Splunk platform instance on which the Splunk Machine Learning Toolkit is installed.

Most of the visualizations are also displayed when using particular Machine Learning Toolkit Assistants including the Predict Numeric Fields Assistant, Detect Numeric Outliers Assistant, Forecast Time Series Assistant, and Cluster Numeric Events Assistant.

Boxplot Chart

Box Plot Chart.png

Use the Boxplot Chart to show the minimum, lower quartile, median, upper quartile, and maximum of each field.

Boxplot requires the input of the macro | `boxplot` in order to render. Failing to include the macro displays an error.

This image shows the Boxplot Chart visualization rendered for a time frame of the last 24 hours taken from the Showcase example to Cluster Behavior by App Usage.

The box plot chart visualization expects five rows corresponding to min, max, median, lower quartile and upper quartile, in any order.

  • exactperc25 is the lower quartile
  • exactperc75 is the upper quartile

Syntax

search_fragment = | boxplot  ...

Example

... | inputlookup app_usage.csv | `boxplot`

Downsampled Line Chart (LinesViz)

MLApp Modviz lines.png

Use the Downsampled Line Chart to show values and trends over time implementing downsampling to show large numbers of points.

The following image shows the Actual vs. Predicted Line Chart and the Residuals Line Chart that are also available when using the Predict Numeric Fields Assistant.

This image shows the Actual vs. Predicted Line Chart and the Residuals Line Chart visualizations taken from the Showcase example to Predict Server Power Consumption.

Syntax

search_fragment = | table <xAxis> <yAxis1> <yAxis2> ...

Example

... | table _time, "median_house_value", "predicted(median_house_value)" ...

Forecast Chart (ForecastViz)

MLApp Modviz forecast.png

Use the Forecast Chat to show the forecasted value for time series data.

The following image shows the Forecast Chart that is available when using the Forecast Time Series Assistant.

This screen capture shows the Forecast Chart as taken from the Showcase example to Predict Monthly Sales.

Syntax

search_fragment = | timechart count [by comparison_category] | `modvizpredict(<field>, <algorithm>, <futuretimespan>, <holdback>, <confidenceInterval>)`

Example

 ... | `modvizpredict("bits_transferred", "LLP5", "224", "112", "95")` ... 

Histogram Chart (HistogramViz)

MLApp Modviz histogram.png

Use the Histogram Chart to show continuous data as bucketed by the bin command.

The following image shows the Residuals Histogram that is available when using the Predict Numeric Fields Assistant.

This screen capture shows the Residuals Histogram as taken from the Showcase example to Predict VPN Usage.

Syntax

search_fragment = | bin <field> bins=<number>

Example

... | bin residual bins=100 ...

Outliers Chart (OutliersViz)

MLApp Modviz outliers.png

Use the Outliers Chart to show the acceptable range for a value and to highlight the points that are outside of this range.

The following image shows the Outliers Chart that is also available when using the Detect Numeric Outliers Assistant.

This screen capture shows the Data and Outliers Chart as taken from the Showcase example to Detect Cyclical Outliers in Logins.

Syntax

search_fragment = | table _time, outlier_variable, lowerBound, upperBound

Example

... | table _time, quantity, lowerBound, upperBound, isOutlier ...

Scatter Line Chart (ScatterLineViz)

MLApp Modviz scatterline.png

Use the Scatter Line Chart to show the relationships between discrete values in two dimensions, as well as an additional identity (x=y) line.

The following image shows the Actual vs. Predicted Scatter Chart that is also available when using the Predict Numeric Fields Assistant.

This screen capture shows the Actual vs. Predicted Scatter Chart as taken from the Showcase example to Predict Future Logins.

Syntax

search_fragment = | table <xAxis> <yAxis>

Example

... | table "median_house_value" "predicted(median_house_value)" ...

Scatterplot Matrix

MLApp scatterplotmatrix.png

Use the Scatterplot Matrix to show the relationships between discrete values in multiple dimensions.

All field values must be numeric in order to render the Scatterplot Matrix.

The following example shows the Scatterplot Matrix that is also available when using the Cluster Numeric Events Assistant.

screen capture shows the Scatterplot Matrix as generated from the Showcase example data to Cluster Neighborhoods by Properties.

Syntax

search_fragment = | table <name_category>, <dimension_1>, <dimension_2>, <dimension_3> ...

Example

... | table cluster, "avg_rooms_per_dwelling", "business_acres", "median_house_value" ...
Last modified on 29 January, 2019
PREVIOUS
Manage models
  NEXT
Classic Assistants overview

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 4.1.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters