Splunk® Machine Learning Toolkit


Register the custom algorithm in the MLTK app

To use the custom algorithm in Splunk Machine Learning Toolkit and for it to be visible in the Splunk platform, you must register the algorithm in the MLTK app. You can register the name of an algorithm using either a manual file update or using the REST API.

To register an algorithm, update the algos.conf file with the name of the custom algorithm you want to add.


Register by manual file update

Use the following steps to register the name of an algorithm by manual file update:

  1. Create or update algos.conf in the following directory:
  2. Add the algorithm name as a stanza, meaning within brackets, to the algos.conf file:
    [<Your new algorithm class name>]
  3. Select Save.
  4. Restart Splunk Enterprise.

Register using the REST API

You must have administrator permissions in your Splunk platform instance to use this registration method.

Use the following code to register the name of a custom algorithm with the REST API:

$ curl -k -u admin:<admin pass> https://localhost:8089/servicesNS/nobody/Splunk_ML_Toolkit/configs/conf-algos -d name="<Your new algorithm class name>"

Implement the algorithm

To implement the algorithm, create and name a python script file (.py file) for the algorithm in the following directory:


The name of the .py file and the name of the main class in the .py file must be the same as the stanza name, the name in brackets, used in the algos.conf file. For example, [LinearRegression] for the LinearRegression algorithm.

<Your new algorithm class name>.py

The name of the algorithm class must be unique and not conflict with other names in the algos.conf file.

Last modified on 25 January, 2024
Adding a custom algorithm to the Splunk Machine Learning Toolkit   Write a Python algorithm class

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 5.4.0, 5.4.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters