topic Re: Add a MLTK Visualization to a splunk dashboard in Dashboards & Visualizations

How to add a MLTK Visualization to a Splunk dashboard?

sebastien07 — Thu, 15 Jun 2023 17:30:06 GMT

I would like to add an outliers' chart from the Machine learning visualizations to my splunk dashboard. The visualization itself is not available in the dashboard studio, and I can't find any documentations for it. Running my query in the search tab works fine because it detects what visualization i want to use automatically.

My query:

index=xxx sourceServiceName="xxx" cn1="xxx" | bucket _time span=1h | stats count by _time | sort - count | eventstats median("count") as median | eval absDev=(abs('count'-median)) | eventstats median(absDev) as medianAbsDev | eval lowerBound=(median-medianAbsDev*exact(8)), upperBound=(median+medianAbsDev*exact(8)) | eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0) | fields _time, "count", lowerBound, upperBound, isOutlier, *

I tried replacing fields with "table" but wouldn't fix it. Any help is appreciated.

Re: Add a MLTK Visualization to a splunk dashboard

ITWhisperer — Thu, 15 Jun 2023 12:53:48 GMT

Use classic SimpleXML dashboards or wait until Studio catches up - you could be waiting for some time though

Re: Add a MLTK Visualization to a splunk dashboard

sebastien07 — Thu, 15 Jun 2023 12:55:48 GMT

Also would like to try that, but i can't find the name of the outlier's chart to use for the SimpleXML

Re: Add a MLTK Visualization to a splunk dashboard

ITWhisperer — Thu, 15 Jun 2023 13:01:35 GMT

Try this

Re: Add a MLTK Visualization to a splunk dashboard

sebastien07 — Thu, 15 Jun 2023 13:20:08 GMT

I think this could work. I'm not used to working with the XML editor for dashboards.
Any idea why this would fail to spit out the results?

<dashboard version="1.1"> <label>test-webtraffic</label> <row> <chart> <search> <query>index=xxx sourceServiceName="xxx" cn1="xxx" | bucket _time span=1h | stats count by _time | sort - count | eventstats median("count") as median | eval absDev=(abs('count' -median)) | eventstats median(absDev) as medianAbsDev | eval lowerBound=(median-medianAbsDev*exact(8)), upperBound=(median+medianAbsDev*exact(8)) | eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0) | fields _time, "count", lowerBound, upperBound, isOutlier, * </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <viz type="Splunk_ML_Toolkit.OutliersViz"></viz> </chart> </row> </dashboard>