Update Splunk MLTK models for Python 3

Check this manual often for updated information about the Splunk platform Python 3 migration. The content is subject to change.

Models that use Python 2 syntax should be unaffected by upgrading to Splunk Enterprise version 8.0, as the Python 2 interpreter is used by default. However, to use Python 3 syntax, you will need to update your models after Splunk Enterprise version 8.0 has been deployed. Upgrading to Splunk Enterprise version 8.1 might impact models, as the Python 3 interpreter is used by default by Splunk Enterprise version 8.1. Also, custom built models and models created with the Experiment Management Framework must be updated to work properly with Python 3.

To update models for the Python 3, in Splunk MLTK you will need to:

• Rerun searches that feed custom models. Running searches again replaces the model.
• Rerun the experiment workflow for any models stored in the Experiment Management Framework. Running the workflow again also replaces the model.
• Confirm that data ingested to train any custom models is still stored in Splunk Enterprise. If data has exceeded retention timeframes, re-ingest the data to feed the model, and rebuild model workflows if necessary.
• Recreate models including the partial_fit parameter.

For information about updating models, see the Splunk Machine Learning Toolkit.