Splunk Cloud Platform

Python 3 Migration

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Update Splunk MLTK models for Python 3

Check this manual often for updated information about the Splunk platform Python 3 migration. The content is subject to change.

Models that use Python 2 syntax should be unaffected by upgrading to Splunk Enterprise version 8.0, as the Python 2 interpreter is used by default. However, to use Python 3 syntax, you will need to update your models after Splunk Enterprise version 8.0 has been deployed. Upgrading to Splunk Enterprise version 8.1 might impact models, as the Python 3 interpreter is used by default by Splunk Enterprise version 8.1. Also, custom built models and models created with the Experiment Management Framework must be updated to work properly with Python 3.

To update models for the Python 3, in Splunk MLTK you will need to:

  • Rerun searches that feed custom models. Running searches again replaces the model.
  • Rerun the experiment workflow for any models stored in the Experiment Management Framework. Running the workflow again also replaces the model.
  • Confirm that data ingested to train any custom models is still stored in Splunk Enterprise. If data has exceeded retention timeframes, re-ingest the data to feed the model, and rebuild model workflows if necessary.
  • Recreate models including the partial_fit parameter.

For information about updating models, see the Splunk Machine Learning Toolkit.

Last modified on 19 October, 2020
Python 3 migration with ITSI
Splunk support policy

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2203, 8.1.2103, 8.2.2105, 8.2.2107, 8.2.2109, 8.2.2111, 8.2.2112, 8.2.2201 (latest FedRAMP release), 8.2.2202, 8.2.2106

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters