Running process and method calling conventions

Become familiar with Splunk platform logic pertaining to running process and method calling conventions. In particular, the fit, partial_fit, apply, and summary commands.

Fit command when partial_fit is False

When running the fit command and the partial_fit parameter is in the default state of False, the fit method of the chosen algorithm is called first. If that method returns a DataFrame the process returns to the search. If that method does not return a DataFrame, the apply command is called to return a DataFrame.

The default for the partial_fit parameter is False (partial_fit=f).

Fit command when partial_fit is True

When running the fit command and the partial_fit parameter is set to True, the partial_fit method of the chosen algorithm is called first on each chunk of 50,000 events. The apply command is then called on those events. This process continues until you run out of events.

Apply command

When running the apply command, the Python object is reconstructed using its codec. Then the apply command is called on the events, chunk by chunk.

Summary command

Similar to running the apply command, when running the summary command, the Python object is reconstructed using its codec. Once done, the summary command is called.