Splunk® Machine Learning Toolkit

ML-SPL API Guide

Running process and method calling conventions

The Splunk platform applies logic when running process and method calling conventions. For MLTK and ML-SPL users, the following commands can be of particular interest:

  • Running the fit command when partial_fit is False
  • Running the fit command when partial_fit is True
  • Running the apply command
  • Running the summary commands

Running the fit command when partial_fit is False

When running the fit command and the partial_fit parameter is False, the fit method of the chosen algorithm is called first. If that method returns a DataFrame the process returns to the search. If that method does not return a DataFrame, the apply command is called to return a DataFrame.

The default for the partial_fit parameter is False (partial_fit=f).

This image shows a running process diagram for the fit command.

Running the fit command when partial_fit is True

When running the fit command and the partial_fit parameter is True, the partial_fit method of the chosen algorithm is called first on each chunk of 50,000 events. The apply command is then called on those events. This process continues until you run out of events.

This image shows a running process diagram for the partial fit command.

Running the apply command

When running the apply command, the Python object is reconstructed using its codec. Then the apply command is called on the events, chunk by chunk.

This image shows a running process diagram for the apply command.

Running the summary command

Similar to running the apply command, when running the summary command, the Python object is reconstructed using its codec. Once done, the summary command is called.

This image shows a running process diagram for the summary command.

Last modified on 06 February, 2024
Custom algorithm template   Using codecs

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 5.1.0, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 5.3.3, 5.4.0, 5.4.1, 5.4.2, 5.5.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters