Models

The Splunk Machine Learning Toolkit (MLTK) provides custom search commands for machine learning. These commands use model files to store machine learning algorithm results on a dataset. This model can then be applied to other datasets.

Models are Splunk platform knowledge objects with configurable sharing and permissions.

Under the Models tab of the MLTK navigation bar, access any models created using the fit command on the Search tab, or those made through the Classic layout of the guided modeling Assistants.

Creating and using models

Models are created using the fit command and applied to datasets using the apply command. For more details, see:

• Understanding the fit and apply commands
• Search commands for machine learning

Namespacing and permissions

By default, MLTK models created with the fit command are created in the namespace of the user who ran the search.

Managing model permissions within Lookups

Model permissions can be managed from within the Models page, or via Lookups. Navigate to Settings > Lookups to access or update MLTK knowledge object permissions. Model files on this page are prefixed with __mlspl_. For example, a model named my_model is contained in the __mlspl_my_model.csv knowledge object.

See Manage knowledge object permissions in the Knowledge Manager Manual for more details.

You can also prefix model names to manage permissions by using the fit, apply, summary, and deletemodel custom search commands:

Prefix	SPL command(s)	Result
No prefix	fit ... into <model_name>	The fit command creates the model in the user's namespace.
No prefix	apply <model_name> summary <model_name> deletemodel <model_name>	These commands use the first available model with the specified <model_name>. If a model with this name is available in both the user's private namespace and the shared application namespace, the model in the user's private namespace is used. If a model with this name is available only in the shared namespace, it is used.
app:	fit ... into app:<model_name>	The fit command saves the model into the shared application namespace. By default, only the admin and power roles can save models into the shared application namespace.
app:	apply app:<model_name> summary app:<model_name> deletemodel app:<model_name>	These commands use the model from the shared application namespace even if a model with the same name exists in the user's private namespace.

The deletemodel command follows standard Splunk plaftorm namespace rules. If the specified model name exists in the shared app namespace but not in the user's private namespace, the shared model is deleted if the user has write permissions on it.

Sharing models from other Splunk apps

The MLTK can access pre-trained models provided by other Splunk apps, provided that:

• The model to be shared has its sharing level set to "global" using standard knowledge object access settings. See Make an object available to users of all apps in the Knowledge Manager Manual.
• The model to be shared does not have the same name as a model that already exists in the MLTK.

For more information about building custom Splunk apps, see the Splunk developer portal.

Upgrading from MLTK versions 2.2 and earlier

Prior to MLTK version 2.3, models were created in the shared application namespace. By default, all users could read from them and write to them.

Model namespacing and permissions have changed in version 2.3, as described in Namespacing and permissions.

SPL command(s)	Result on MLTK versions 2.3 and later	Result on MLTK versions 2.2 and earlier
fit... into <new_model_name>	Creates a new model in the user's private namespace	Creates a new model in the shared application namespace

While all users can read models created in earlier versions of the MLTK, only admin and power roles can write to those models.