Upgrade the Machine Learning Toolkit
The Machine Learning Toolkit (MLTK) regularly releases new features and enhancements. Refer to this document to learn how to keep your iteration of the MLTK up to date, as well as of any release related dependencies.
The current version of the Machine Learning Toolkit is 5.2.1, but this is limited to a minor enhancement from version 5.2.0 of the MLTK. There are no new features in version 5.2.1.
To learn about the latest MLTK features and enhancements, see What's new.
Running version 5.0.0 or above of the MLTK requires Splunk Enterprise 8.0 or above or Splunk Cloud. The Splunk Machine Learning Toolkit requires the Python for Scientific Computing (PSC) add-on. Version 5.0.0 or above of the MLTK requires version 2.0.x of the Python for Scientific Computing add-on. Versions 2.0.x of the Python for Scientific Computing add-on use Python 3.
In order to save models, users need the
upload_lookup_files capability included in their role.
Specific version dependencies
For version information that includes MLTK, the PSC add-on, Python, and Splunk Enterprise, see Machine Learning Toolkit version dependencies matrix.
If you have any custom algorithms that rely on the PSC libraries, upgrading the PSC library add-on will impact those algorithms. You must re-train any models (re-run the search that used the
fit command) using those algorithms after you upgrade the PSC add-on.
MLTK Version PSC Version 5.2.1 2.0.0, 2.0.1, or 2.0.2 5.2.0 2.0.0, 2.0.1, or 2.0.2 5.1.0 2.0.0, 2.0.1, or 2.0.2 5.0.0 2.0.0, 2.0.1, or 2.0.2 4.4.2 1.3 or 1.4 4.4.1 1.3 or 1.4 4.4.0 1.3 or 1.4 4.3.0 1.3 or 1.4 4.2.0 1.3 or 1.4 4.1.0 1.3 4.0.0 1.3 3.4.0 1.3 3.3.0 1.2 or 1.3 3.2.0 1.2 or 1.3 3.1.0 1.2
Versions 2.0.2 and 2.0.1 of the PSC add-on are limited to minor library upgrades from version 2.0.0. There are no differences in functionality to version 2.0.0 of the PSC add-on.
Any algorithms that have been imported from the Python for Scientific Computing add-on into the Machine Learning Toolkit are overwritten when the MLTK app is updated to a new version. Prior to upgrading the MLTK , save your custom algorithms and re-import them manually after the upgrade.
Algorithms are stored in
$SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/bin/algos on Unix-based systems and
%SPLUNK_HOME%\etc\apps\Splunk_ML_Toolkit\bin\algos on Windows systems.
Splunk Cloud deployments
For Splunk Cloud trial, self-service Splunk Cloud, or Managed Splunk Cloud, open a ticket with support and request the Python for Scientific Computing add-on and Machine Learning Tooklit app be upgraded to the latest version for you.
Splunk Enterprise single instance deployments
Follow these directions for single instance deployments.
Upgrade the Splunk Machine Learning Toolkit app on your single instance Splunk Enterprise
If a newer version of the Python for Scientific Computing add-on is required for the newer version of the Splunk Machine Learning Toolkit, a message will display when you run the Splunk Machine Learning Toolkit after the upgrade instructing you to install a newer version of the Python for Scientific Computing add-on.
Update an app or add-on in Splunk Web
In Splunk Web, click the Update option on the app icon in the left-hand Apps bar.
The Update option appears when a new version of an app is available on Splunkbase.
Alternatively, you can do the following:
- Download the latest version of the app from Splunkbase.
- In Splunk Web, click on the gear icon next to Apps in the left navigation bar.
- On the Apps page, click Install app from file.
- Click Choose File, navigate to and select the package file for the app or add-on, then click Open.
- Check the Upgrade app box.
- Click Upload.
Update an existing app on your Splunk instance using the CLI
Run the command line that corresponds to your operating system.
|Operating system||Command line|
Alternatively, unpack/unzip the file then copy the app directory to
$SPLUNK_HOME/etc/apps on Unix based systems or
%SPLUNK_HOME%\etc\apps on Windows systems.
Splunk Enterprise distributed deployments
In a distributed deployment of Splunk Enterprise, update the Splunk Machine Learning Toolkit, and Python for Scientific Computing add-on if necessary, on every Splunk instance where the application is installed. The Python for Scientific Computing and the Splunk Machine Learning Toolkit should be installed on all search heads where the Splunk Machine Learning Toolkit is used.
If Python for Scientific Computing is installed on your indexers in order to use the distributed apply feature of the Splunk Machine Learning Toolkit, you need to update the Python for Scientific Computing add-on on your indexers as well as your search heads if an update is required. If an update for Python for Scientific Computing is required, you will receive a message indicating this when you run the Splunk Machine Learning Toolkit after upgrading. For information about the distributed apply feature, see Use your indexers to apply models.
If you use search head clusters or indexer clusters, use the deployment methodology of your choice to make the updates.
- To learn about updating search head cluster members, see Use the deployer to distribute apps and configuration updates in the Distributed Search manual.
- To learn about about updating peers in an indexer cluster, see Manage app deployment across all peers in the Managing Indexers and Clusters of Indexers manual.
Install the GitHub for Machine Learning App
Machine Learning Toolkit version dependencies
This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 5.2.1