Splunk® Machine Learning Toolkit

User Guide

This documentation does not apply to the most recent version of Splunk® Machine Learning Toolkit. For documentation on the most recent version, go to the latest release.

Splunk Machine Learning Toolkit version dependencies

The Splunk Machine Learning Toolkit (MLTK) releases updates on a regular schedule. Keep your instance of MLTK and affiliated add-ons up-to-date to access the latest features.

About the PSC add-on

MLTK requires installation of the Python for Scientific Computing (PSC) add-on.

Versions 4.1.2, 4.1.0, and 3.1.0 of the Python for Scientific Computing (PSC) add-on include the ONNX library. Version 4.1.2, 4.1.0, or 3.1.0 of the PSC add-on are required to bring pre-trained ONNX models into MLTK. This ONNX model feature is only available with MLTK version 5.4.0. See, Upload and inference pre-trained ONNX models in MLTK.

Version 4.0.0 of the Python for Scientific Computing (PSC) add-on provides updates and adds several libraries in the package. In particular, Pytorch, cpuonly, transformers, onnxruntime, pydantic, and watchdog. Version 4.0.0 of PSC is only available using MLTK version 5.3.3. Version 4.0.0 of the PSC add-on requires additional installation steps.

The build size of the PSC add-on version 4.0.0 might exceed the default value of max_upload_size which can prevent you from installing the package using the Install app from file option under Manage Apps. To install PSC 4.0.0 you must create a web.conf file , update max_upload_size to a higher value, and restart Splunk from your terminal. See Install version 4.0.0 of the Python for Scientific Computing add-on.

Version 3.0.2 of the Python for Scientific Computing (PSC) add-on is limited to bug fixes only. Version 3.0.1 of the Python for Scientific Computing (PSC) add-on is limited to configuration updates for deployment on Splunk Cloud Platform.

Version 3.0.0 of the Python for Scientific Computing (PSC) add-on brings updates to several libraries in the package. In particular, Numpy, Scipy, scikit-learn, Statsmodels, and Networkx are upgraded to their latest available versions.

If you have any custom algorithms that rely on the PSC libraries, upgrading the PSC add-on will impact those algorithms. You must re-train any models (re-run the search that used the fit command) using those algorithms after you upgrade the PSC add-on.

Version matrix

See the following table for the compatible combinations of MLTK, the PSC add-on, Python, and the Splunk platform:

MLTK version PSC add-on version Python version Splunk platform version Notes
5.4.0 4.1.2 3 Splunk Enterprise 9.2.x

or Splunk Cloud Platform

Version 3.1.0, 4.1.0, or 4.1.2 of the PSC add-on is required to use the upload ONNX models feature.
3.1.0, 4.1.0, or 4.1.2 3 Splunk Enterprise 8.1.x, 8.2.x, 9.0.0, 9.0.1, 9.0.5, or 9.1.0

or Splunk Cloud Platform

Version 3.1.0, 4.1.0, or 4.1.2 of the PSC add-on is required to use the upload ONNX models feature.
5.3.3 3.0.2, 3.1.0, 4.0.0, 4.1.0, or 4.1.2 3 Splunk Enterprise 8.1.x, 8.2.x, or 9.0.0

or Splunk Cloud Platform

Version 4.0.0 of the PSC add-on requires additional installation steps. See, Install version 4.0.0 of the PSC add-on.

Deprecated support of Internet Explorer.

5.3.1 3.0.0, 3.0.1, or 3.0.2 3 Splunk Enterprise 8.0.x, 8.1.x, 8.2.x, or 9.0.0

or Splunk Cloud Platform

Version 3.0.2 of the PSC add-on is limited to bug fixes.
5.3.0 3.0.0, 3.0.1, or 3.0.2 3 Splunk Enterprise 8.0.x, 8.1.x, 8.2.x, or 9.0.0

or Splunk Cloud Platform

This version of MLTK requires version 3.0.0, 3.0.1, or 3.0.2 of the PSC add-on. Users upgrading to this version must retrain models created in earlier versions of MLTK.
5.2.2 2.0.0, 2.0.1, or 2.0.2 3 Splunk Enterprise 8.0.x, 8.1.x, or 8.2.0

or Splunk Cloud Platform

This version of MLTK is limited to a minor enhancement.
5.2.1 2.0.0, 2.0.1, or 2.0.2 3 Splunk Enterprise 8.0.x, 8.1.x, or 8.2.0

or Splunk Cloud Platform

This version of MLTK is limited to a minor enhancement.
5.2.0 2.0.0, 2.0.1, or 2.0.2 3 Splunk Enterprise 8.0.x, 8.1.x, or 8.2.0

or Splunk Cloud Platform

This version of MLTK is available with Splunk Enterprise version 8.0.x, 8.1.x, or 8.2.0.
5.1.0 2.0.0, 2.0.1, or 2.0.2 3 Splunk Enterprise 8.0.x or 8.1.x

or Splunk Cloud Platform

This version of MLTK is available with Splunk Enterprise version 8.0.x or 8.1.x.
5.0.0 2.0.0, 2.0.1, or 2.0.2 3 Splunk Enterprise 8.0.x or 8.1.x

or Splunk Cloud Platform

This version of MLTK is only available with Splunk Enterprise version 8.0.x or 8.1.x. Users upgrading to this version must retrain models created in earlier versions of MLTK. The file extension for models has changed from .csv to .mlmodel.
4.5.0 1.4 2.x Splunk Enterprise 7.x

or Splunk Cloud Platform

This version includes all the features of version 5.0.0 barring the support of the random_state parameter of the DensityFunction anomaly detection algorithm. Models created in earlier versions of MLTK maintain compatibility and do not require retraining.
Last modified on 21 March, 2024
Upgrade the Splunk Machine Learning Toolkit   Preparing your data for machine learning

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 5.4.0

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters