Splunk® Machine Learning Toolkit

User Guide

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Machine Learning Toolkit. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Upgrade the Machine Learning Toolkit

The Machine Learning Toolkit releases new features and enhancements regularly. Refer to this document to learn how to keep your iteration of the toolkit up to date, as well as of any release related dependencies.

To learn about the latest toolkit features and enhancements, see What's new.

Requirements

Running version 4.3.0 of the toolkit requires Splunk Enterprise 7.0 or later or Splunk Cloud. The Splunk Machine Learning Toolkit requires the Python for Scientific Computing add-on. Upgrading to version 3.4.0 or above (4.0.0, 4.1.0, 4.2.0, and 4.3.0 currently) of the toolkit requires upgrading to version 1.3 of the Python for Scientific Computing add-on.

In order to save models, users need the upload_lookup_files capability included in their role.

Choose to upgrade to version 1.4 of the Python for Scientific Computing add-on to access all the new features in version 4.3 of the toolkit.

Linux 32-bit support is not available should you upgrade to version 1.4 of the Python for Scientific Computing add-on.

You cannot access new features in the MLTK without upgrading to the latest version of the toolkit. Versions 3.4.0 and above of the toolkit require upgrading to versions 1.3 or 1.4 of the PSC add-on. See the version dependencies table for the specific requirements between toolkit and PSC add-on versions.

Specific version dependencies

MLTK Version PSC Version
4.3 1.3 or 1.4
4.2 1.3 or 1.4
4.1 1.3
4.0 1.3
3.4 1.3
3.3 1.2 or 1.3
3.2 1.2 or 1.3
3.1 1.2

If you have written any custom algorithms that rely on the PSC libraries, upgrading to version 1.3 or 1.4 the PSC library add-on will impact those algorithms. You will need to re-train any models (re-run the search that used the fit command) using those algorithms after you upgrade the PSC add-on.

Any algorithms that have been imported from the Python for Scientific Computing add-on into the MLTK are overwritten when the MLTK app is updated to a new version. Prior to upgrading the MLTK, save your custom algorithms and re-import them manually after the upgrade.
Algorithms are stored in $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/bin/algos on Unix-based systems and %SPLUNK_HOME%\etc\apps\Splunk_ML_Toolkit\bin\algos on Windows systems.

Splunk Cloud deployments

For Splunk Cloud trial, self-service Splunk Cloud, or Managed Splunk Cloud, open a ticket with support and request the Python for Scientific Computing add-on and Machine Learning Toolkit app be upgraded to the latest version for you.

Splunk Enterprise deployments

Follow these directions for either single or distributed deployments.

Single instance deployment

Upgrade the Machine Learning Toolkit app on your single instance Splunk Enterprise

If a newer version of the Python for Scientific Computing add-on is required for the newer version of the Machine Learning Toolkit, a message will display when you run the Machine Learning Toolkit after the upgrade instructing you to install a newer version of the Python for Scientific Computing add-on.

Update an app or add-on in Splunk Web

In Splunk Web, click the Update option on the app icon in the left-hand Apps bar.
The Update option appears when a new version of an app is available on Splunkbase.

Alternatively, you can do the following:

  1. Download the latest version of the app from Splunkbase.
  2. In Splunk Web, click on the gear icon next to Apps in the left navigation bar.
  3. On the Apps page, click Install app from file.
  4. Click Choose File, navigate to and select the package file for the app or add-on, then click Open.
  5. Check the Upgrade app box.
  6. Click Upload.

Update an existing app on your Splunk instance using the CLI

Run the following from the command line.

Unix/Linux:

./splunk install app <app_package_filename> -update 1 -auth <username>:<password>

Windows:

splunk install app <app_package_filename> -update 1 -auth <username>:<password>

Alternatively, unpack/unzip the file then copy the app directory to $SPLUNK_HOME/etc/apps on Unix based systems or %SPLUNK_HOME%\etc\apps on Windows systems.

Distributed deployment

In a distributed deployment of Splunk Enterprise, update the Machine Learning Toolkit, and Python for Scientific Computing add-on if necessary, on every Splunk instance where the application is installed. Python for Scientific Computing and the Machine Learning Toolkit should be installed on all search heads where the Machine Learning Toolkit is used.

If Python for Scientific Computing is installed on your indexers in order to use the distributed apply feature of the Machine Learning Toolkit, you need to update the Python for Scientific Computing add-on on your indexers as well as your search heads if an update is required. If an update for Python for Scientific Computing is required, you will receive a message indicating this when you run the Machine Learning Toolkit after upgrading. For information about the distributed apply feature, see Use your indexers to apply models.

If you use search head clusters or indexer clusters, use the deployment methodology of your choice to make the updates.

Last modified on 17 November, 2021
PREVIOUS
Install the Machine Learning Toolkit
  NEXT
Using the Splunk Machine Learning Toolkit

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 4.3.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters