Model permissions in the Splunk Machine Learning Toolkit

The Models tab of MLTK presents the models in your Splunk Machine Learning Toolkit in list form. By default, MLTK models created with the fit command are created in the namespace of the user who ran the search. To view this page, click Models on the MLTK navigation bar.

In the resulting rows you can see what types of models are present, who owns them, and how they are shared. You only see the models that you have permission to see. Optionally filter the list view to see all stored models, your stored models, or only the models related to the MLTK app.

Select any row to expand the row and view model details including:

• Date last modified
• Algorithm used
• Fields used when training the model
• Model owner
• Sharing settings

Managing model permissions

Change model permissions to change their availability to other users. You can set up read and write access by role, and you can make models globally accessible, restricted to a particular app context, or private to a single user. For more information about model permissions, see Namespacing and permissions.

By default, only admin users can set permissions for models.

Follow these steps to modify permissions for a model in the Splunk Machine Learning Toolkit:

1. Select Models on the MLTK navigation bar.
2. On the Models page, select the model that requires permission edits.
3. Select the current permission (Private, App or Public) in the Sharing column. This will only be editable if your current user has permission to edit that model.
4. In the resulting Edit Permissions window make your changes and select Save.

Under the '''Models''' tab you only see models created using the fit command on the Search tab, or those made through the legacy layout of the guided modeling Assistants under the Classic tab. You do not see models that were created within the framework of an Experiment.

Managing model permissions within Lookups

Model permissions are managed from within the Models page, or through Lookups. Navigate to Settings > Lookups to access or update MLTK knowledge object permissions. For more details, see Manage knowledge object permissions.

Model files on this page are prefixed with __mlspl_. For example, a model named my_model is contained in the __mlspl_my_model.csv knowledge object. You can also prefix model names to manage permissions by using the fit, apply, summary, and deletemodel custom search commands:

Prefix	SPL command(s)	Result
No prefix	fit ... into <model_name>	The fit command creates the model in the user's namespace.
No prefix	apply <model_name>	The apply command uses the first available model with the specified <model_name>. If a model with this name is available in both the user's private namespace and the shared application namespace, the model in the user's private namespace is used. If a model with this name is available only in the shared namespace, it is used.
No prefix	summary <model_name>	The summary command uses the first available model with the specified <model_name>. If a model with this name is available in both the user's private namespace and the shared application namespace, the model in the user's private namespace is used. If a model with this name is available only in the shared namespace, it is used.
No prefix	deletemodel <model_name>	The deletemodel command uses the first available model with the specified <model_name>. If a model with this name is available in both the user's private namespace and the shared application namespace, the model in the user's private namespace is used. If a model with this name is available only in the shared namespace, it is used.
app: prefix	fit ... into app:<model_name>	The fit command saves the model into the shared application namespace. By default, only the admin and power roles can save models into the shared application namespace.
app: prefix	apply app:<model_name>	This command uses the model from the shared application namespace even if a model with the same name exists in the user's private namespace.
app: prefix	summary app:<model_name>	This command uses the model from the shared application namespace even if a model with the same name exists in the user's private namespace.
app: prefix	deletemodel app:<model_name>	This command uses the model from the shared application namespace even if a model with the same name exists in the user's private namespace.

The deletemodel command follows standard Splunk plaftorm namespace rules. If the specified model name exists in the shared app namespace but not in the user's private namespace, the shared model is deleted if the user has write permissions on it.