Splunk® Machine Learning Toolkit

User Guide

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Machine Learning Toolkit. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

MLTK deep dives overview

The Splunk Machine Learning Toolkit (MLTK) lets you create, validate, manage, and operationalize machine learning models through a guided user interface. If you're unsure where to get started with MLTK you can use this series of deep dives to get walk-throughs of implementing the machine learning (ML) search commands that ship with MLTK for specific ML goals.

You can follow each deep dive from start to finish and implement the same operational outcomes in your own Splunk platform environment. Each deep dive consists of some example data sources, sample SPL code, and instructions for implementing the analytic.

You might need to tun or modify these examples to work properly on your data. SPL knowledge is valuable when trying to implement these deep dives in your own environment.

What makes ML different from other analytics in Splunk products?

Most analytics in the Splunk platform revolve around hard-to-find types of searches, where you are trying to spot a particular event or set of events that make up something of interest. For example, looking for memory errors on a server, or looking for a user running a process that is known to be malicious.

These types of analytics can usually be implemented with a single SPL search, whereas with ML you almost always need to run two searches: one to train a model, using the fit command, and one to apply a model, using the apply command.

The fit command is similar to the outputlookup command, and the apply is similar to the lookup. The apply stage is usually analogous with the hard-too-find detection search, but the training of models can seem unusual if you are new to machine learning. To learn more about how to use the fit and apply commands, see Using the fit and apply commands.

Available deep dives

The following deep dives are available:

If you encounter questions while working on these deep dives, see Troubleshooting the deep dives.

See also

See the following resources to learn more about the Splunk Machine Learning Toolkit:

See the following resources to learn about the dedicated ML training course, our .conf archives, and numerous blog posts on the subject of machine learning and MLTK:

Last modified on 26 September, 2023
PREVIOUS
Develop and package a custom machine learning model in MLTK
  NEXT
Deep dive: Using ML to identify user access anomalies

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 4.5.0, 5.0.0, 5.1.0, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 5.3.3, 5.4.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters