Splunk® Machine Learning Toolkit

User Guide

Download manual as PDF

Download topic as PDF

Creating, sharing, and deleting models in the Machine Learning Toolkit

The Splunk Machine Learning Toolkit (MLTK) provides custom search commands for machine learning. These commands use model files to store machine learning algorithm results on a dataset. This model can then be applied to other datasets.

Models are Splunk platform knowledge objects with configurable sharing and permissions.

Under the Models tab of the MLTK navigation bar, access any models created using the fit command on the Search tab, or those made using the Classic layout of the guided modeling Assistants.

For further details on custom search commands, see Search commands for machine learning.
For further details on legacy Assistants, see the Classic Assistants Overview.

Creating and using models

By default, MLTK models created with the fit command are created in the namespace of the user who ran the search. Models are created using the fit command and applied to datasets using the apply command. For more details, see:

For further details on the fit and apply commands, see Understanding the fit and apply commands.

Sharing models from other Splunk apps

The MLTK can access pre-trained models provided by other Splunk apps, provided the following setting are in place:

  • The model to be shared has its sharing level set to global using standard knowledge object access settings.
  • The model to be shared does not have the same name as a model that already exists in the MLTK.

For information on knowledge object access settings, see the Knowledge Manager Manual.
For more information about building custom Splunk apps, see the Develop apps and add-ons for Splunk Enterprise in the Splunk developer portal.

Deleting models

You can also delete models through the Models page. Follow these steps to delete a model:

  1. Click Models on the MLTK navigation bar.
  2. On the Models page, select the model that needs deletion.
  3. Click Delete in the Actions column.
  4. In the Delete Model window, click Delete again to verify that you want to delete the model.
Last modified on 21 January, 2020
Cluster Numeric Events Classic Assistant workflow
Model permissions in the Machine Learning Toolkit

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 4.4.0, 4.4.1, 4.4.2, 4.5.0, 5.0.0, 5.1.0, 5.2.0

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters