Install the Splunk Machine Learning Toolkit

The Splunk Machine Learning Toolkit (MLTK) enables users to create, validate, manage, and operationalize machine learning models through a guided user interface. Follow these directions to install MLTK.

Requirements for MLTK

Running MLTK version 5.4.1 requires Splunk Enterprise 8.1.x or higher or Splunk Cloud Platform.

The Splunk Machine Learning Toolkit relies on the Python for Scientific Computing (PSC) add-on. Install or upgrade to a compatible version of the PSC add-on based on your operating system:

If you have any custom algorithms that rely on the PSC libraries, upgrading the PSC add-on impacts those algorithms. You must re-train any models (re-run the search that used the fit command) using those algorithms after you upgrade PSC.

• Python for Scientific Computing (for Mac Intel)
• Python for Scientific Computing (for Mac Apple Silicon)
• Python for Scientific Computing (for Linux 64-bit)
• Python for Scientific Computing (for Windows 64-bit)

On some Windows operating systems, installing PSC through the Splunk Manage Apps user interface results in an error. This error is usually benign and you can ignore it. In some cases, you might need to manually unpack the package in the apps directory to get past the error.

Version dependencies

For version information that includes MLTK, the PSC add-on, Python, and the Splunk platform, see Machine Learning Toolkit version dependencies matrix.

MLTK version	PSC version
5.4.1	3.1.0, 4.1.0, 4.1.2, or 4.2.0
5.4.0	3.1.0, 4.1.0, or 4.1.2
5.3.3	3.0.2, 3.1.0, 4.0.0, 4.1.0, or 4.1.2
5.3.1	3.0.0, 3.0.1, or 3.0.2
5.3.0	3.0.0, 3.0.1, or 3.0.2
5.2.2	2.0.0, 2.0.1, or 2.0.2
5.2.1	2.0.0, 2.0.1, or 2.0.2
5.2.0	2.0.0, 2.0.1, or 2.0.2
5.1.0	2.0.0, 2.0.1, or 2.0.2
5.0.0	2.0.0, 2.0.1, or 2.0.2
4.5.0	1.4

Install from Manage Apps

Follow these steps to install the Splunk Machine Learning Toolkit using Manage Apps:

1. Download the Splunk Machine Learning Toolkit app from Splunkbase.
2. In Splunk Web, select the Manage icon next to Apps in the left navigation bar as shown in the following image:
3. On the Apps page, select Install app from file.
4. Select Choose File to navigate to and select the package file for the Machine Learning Toolkit. Then click Open.
5. Select Upload.
6. Restart your Splunk instance.
7. Following the restart, you can see the MLTK app listed and available for use.

Install from Find more apps

Perform the following steps to install the Splunk Machine Learning Toolkit using Find more apps:

1. Select Find more apps from the left navigation bar as shown in the following image:
2. In the search field you can use keywords such as "machine learning" to find the Splunk Machine Learning Toolkit.
3. Choose Install.
4. Input your username and password, review the terms and conditions, then Agree and Install.
5. Restart your Splunk instance.
6. Following the restart, you can see the MLTK app listed on your home page and available for use.

Install from the command line

On the command line (CLI), run the command that corresponds to your operating system:

Operating system	Command line
Unix/Linux	./splunk install app <path/packagename>
Windows	splunk install app <path\packagename>

Alternatively, unpack/unzip the file then copy the app directory to $SPLUNK_HOME/etc/apps on Unix based systems or %SPLUNK_HOME%\etc\apps on Windows systems.

Where to install

See the following table for where to install MLTK and PSC:

In a distributed deployment and depending on your environment, you might need to install MLTK and PSC in multiple places.

Splunk component	Supported Y/N	MLTK required	PSC required	Description
Search Heads	Yes	Yes	Yes	Install MLTK and PSC to all search heads where the MLTK is used.
Indexers	No	No	No	Do not install on Indexers.
Heavy Forwarders	No	No	No	Do not install on Heavy Forwarders
Universal Forwarders	No	No	No	Do not install on Universal Forwarders
Light Forwarders	No	No	No	Do not install on Light Forwarders

Distributed deployment feature compatibility

See the following table for the compatibility of MLTK with Splunk distributed deployment features:

Distributed deployment feature	Supported	Actions required
Search Head Clusters	Yes	Search heads must be running Splunk Enterprise version 6.6.x or higher.
Indexer Clusters	No	Do not install on Indexer Clusters.

Splunk Machine Learning Toolkit files

You can view the source code for the Splunk Machine Learning Toolkit app in Unix and Windows environments:

• For Unix-based systems, see $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit.
  
• For Windows systems, see %SPLUNK_HOME%\etc\apps\Splunk_ML_Toolkit.

The Splunk Machine Learning Toolkit is not open source and MLTK source code is provided as an example only, and for educational purposes.

See the following table for sub-directory names and descriptions:

Subdirectory	Description
appserver/static and /bin	Contains the underlying code files for Python, JavaScript, CSS, and images.
/default	Contains configuration and dashboard files.
/lookups	Contains the sample datasets used in the Showcase examples, along with more information about the datasets and their licenses.

Bundle replication

Permanent model files, sometimes referred to as learned models or encoded lookups, are saved on disk. These files follow Splunk knowledge object rules, including permissions and bundle replication. Bundle replication is the process by which knowledge objects on the search head are distributed to the indexers.

The Splunk Machine Learning Toolkit includes a number of example model files that support the Showcase. These examples are powered by .CSV lookup files. To prevent performance issues, these .CSV lookup files are not included in MLTK bundle replication processes.