Creating, sharing, and deleting models in the Machine Learning Toolkit
The Splunk Machine Learning Toolkit (MLTK) provides custom search commands for machine learning. These commands use model files to store machine learning algorithm results on a dataset. This model can then be applied to other datasets.
About Models
Models are Splunk platform knowledge objects with configurable sharing and permissions. Models store in the same way as lookups.
Under the Models tab of the MLTK navigation bar, access any models created using the fit
command on the Search tab, or those made using the Classic layout of the guided modeling Assistants. By default, user-level (private) models store here: $SPLUNK_HOME/etc/users/admin/Splunk_ML_Toolkit/lookups
Model size is impacted by the data used and the chosen algorithm. Maximum model size is configurable and can be viewed within the MLTK Settings (Settings/ Algo Name/ max_model_size_mb
).
- To learn more about Lookups, see About Lookups in the Knowledge Manager Manual
- To learn more about how to manage model size and other MLTK settings, see Configure Algorithm Performance Costs
Creating and using models
By default, MLTK models created with the fit
command are created in the namespace of the user who ran the search. Models are created using the fit
command and applied to datasets using the apply
command. For more details, see:
- To learn more about the
fit
andapply
commands, see Understanding the fit and apply commands
Sharing models from other Splunk apps
The MLTK can access pre-trained models provided by other Splunk apps, provided the following settings are in place:
- The pre-trained model has its sharing level set to global using standard knowledge object access settings.
- The pre-trained model does not have the same name as a model that already exists in the MLTK.
- To learn more about knowledge object access settings, see Knowledge object permissions
- To learn more about building custom Splunk apps, see the Develop apps and add-ons for Splunk Enterprise
Deleting models
You can also delete models through the Models page. Follow these steps to delete a model:
- Click Models on the MLTK navigation bar.
- On the Models page, select the model that needs deletion.
- Click Delete in the Actions column.
- In the Delete Model window, click Delete again to verify that you want to delete the model.
Cluster Numeric Events Classic Assistant workflow | Model permissions in the Machine Learning Toolkit |
This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 4.4.0, 4.4.1, 4.4.2, 4.5.0, 5.0.0, 5.1.0, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1
Feedback submitted, thanks!