Splunk® Machine Learning Toolkit

User Guide

Download manual as PDF

Download topic as PDF

Model permissions in the Machine Learning Toolkit

The Models page presents the models in your Splunk Machine Learning Toolkit in list form. By default, MLTK models created with the fit command are created in the namespace of the user who ran the search. You will only see the models that you have permission to see. To view this page, click Models on the MLTK navigation bar.

In the displayed row(s), you can see what types of models are present, who owns them, and how they are shared.

Click the > symbol in the first column to expand the row. and view model details including:

  • Date last modified
  • Algorithm used
  • Fields used when training the model
  • Model owner
  • Sharing settings

This screen image shows the model details for app_usage_model

Managing model permissions

Change model permissions to change their availability to other users. You can set up read and write access by role, and you can make models globally accessible, restricted to a particular app context, or private to a single user. For more information about model permissions, see Namespacing and permissions.

By default, only the Power and Admin roles can set permissions for models.

Follow these steps to modify permissions for a model in the Machine Learning Toolkit:

  1. Click Models on the MLTK navigation bar.
  2. On the Models page, select the model that requires permission edits.
  3. Click the current permission (Private, App or Public) in the Sharing column. This will only be editable if your current user has permission to edit that model.
  4. In the resulting Edit Permissions window make your changes and click Save.

Under the Models tab you will only see models created using the fit command on the Search tab, or those made through the legacy layout of the guided modeling Assistants under the Classic tab. You will not see models that were created within the framework of an Experiment.

Managing model permissions within Lookups

Model permissions are managed from within the Models page, or via Lookups. Navigate to Settings > Lookups to access or update MLTK knowledge object permissions. For more details, see Manage knowledge object permissions.

Model files on this page are prefixed with __mlspl_. For example, a model named my_model is contained in the __mlspl_my_model.csv knowledge object. You can also prefix model names to manage permissions by using the fit, apply, summary, and deletemodel custom search commands:

Prefix SPL command(s) Result
No prefix

fit ... into <model_name>

The fit command creates the model in the user's namespace.
No prefix apply <model_name> The apply command uses the first available model with the specified <model_name>.
If a model with this name is available in both the user's private namespace and the shared application namespace, the model in the user's private namespace is used.
If a model with this name is available only in the shared namespace, it is used.
No prefix summary <model_name>
The summary command uses the first available model with the specified <model_name>.
If a model with this name is available in both the user's private namespace and the shared application namespace, the model in the user's private namespace is used.
If a model with this name is available only in the shared namespace, it is used.
No prefix deletemodel <model_name>
The deletemodel command uses the first available model with the specified <model_name>.
If a model with this name is available in both the user's private namespace and the shared application namespace, the model in the user's private namespace is used.
If a model with this name is available only in the shared namespace, it is used.
app: prefix fit ... into app:<model_name> The fit command saves the model into the shared application namespace.
By default, only the admin and power roles can save models into the shared application namespace.
app: prefix apply app:<model_name> This command uses the model from the shared application namespace even if a model with the same name exists in the user's private namespace.
app: prefix summary app:<model_name> This command uses the model from the shared application namespace even if a model with the same name exists in the user's private namespace.
app: prefix deletemodel app:<model_name> This command uses the model from the shared application namespace even if a model with the same name exists in the user's private namespace.

The deletemodel command follows standard Splunk plaftorm namespace rules. If the specified model name exists in the shared app namespace but not in the user's private namespace, the shared model is deleted if the user has write permissions on it.

PREVIOUS
Creating, sharing, and deleting models in the Machine Learning Toolkit
  NEXT
Share data in the Machine Learning Toolkit

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 4.4.0, 4.4.1, 4.4.2, 5.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters