object has no attribute 'wasserstein_distance'

DeanS1 — Fri, 07 May 2021 11:49:33 GMT

Machine Learning Toolkit - Density Function

Hello,

I'm trying to use the machine learning tool in order to create a model based on a time frame and then analyze the current time window in order to see if it stands out from an average behavior fort his hour of the day on this day of the week.

When trying to build the model with a command like this:

index=onlineservices "USERACTION: Successful login" earliest=-33d@d latest=-1d@d

| bin _time span=15m

| eval date_minutebin=strftime(_time, "%M")

| eval date_hour=strftime(_time, "%H")

| eval date_wday=strftime(_time, "%A")

| stats count by _time date_minutebin date_hour date_wday

| fit DensityFunction count by "date_minutebin,date_hour,date_wday"

into mydensitymodel threshold=0.5 dist=norm sample=True

I get the following error:

Error in 'fit' command: Error while fitting "DensityFunction" model: 'module' object has no attribute 'wasserstein_distance'

I have also tryed to change the metrics to kolmogorov_smirnov, but I get another error in this case:

Error in 'fit' command: Error while fitting "DensityFunction" model: 'functools.partial' object has no attribute '__module__'

Can someone help me with this? Why the default metrics does not work in my case?

Bellow you ca find an example of the data I get from the first search, before piping into FIT function:

_time date_minutebin date_hour date_wday count

2021-04-29 00:00:00 00 00 Thursday 4

2021-04-29 00:15:00 15 00 Thursday 3

2021-04-29 00:30:00 30 00 Thursday 2

2021-04-29 00:45:00 45 00 Thursday 3

2021-04-29 01:00:00 00 01 Thursday 2

2021-04-29 01:15:00 15 01 Thursday 1

2021-04-29 01:45:00 45 01 Thursday 2

2021-04-29 02:00:00 00 02 Thursday 3

2021-04-29 02:15:00 15 02 Thursday 1

2021-04-29 02:30:00 30 02 Thursday 2

2021-04-29 02:45:00 45 02 Thursday 1

2021-04-29 03:00:00 00 03 Thursday 1

2021-04-29 03:15:00 15 03 Thursday 2

2021-04-29 03:30:00 30 03 Thursday 1

2021-04-29 03:45:00 45 03 Thursday 2

2021-04-29 04:00:00 00 04 Thursday 1

2021-04-29 04:15:00 15 04 Thursday 2

2021-04-29 04:30:00 30 04 Thursday 1

Re: object has no attribute 'wasserstein_distance'

tscroggins — Sat, 08 May 2021 15:45:36 GMT

@DeanS1

Using your sample data, I receive no errors (just training size warnings) with the following baseline:

Splunk Enterprise 8.1.1
Python for Scientific Computing 2.0.1
Splunk Machine Learning Toolkit 5.2.0

Is your training data clean?

Do you have the correct combination of Splunk Enterprise, MLTK, and Python for Scientific Computing installed? See https://docs.splunk.com/Documentation/MLApp/5.2.1/User/MLTKversiondepends. Note that Splunk Enterprise Security has separate requirements.

Re: object has no attribute 'wasserstein_distance'

DeanS1 — Mon, 10 May 2021 08:15:31 GMT

Thank you for the suggestion.

We have splunk version 7.2.8

Machine learning 4.5 - the newer we could install on 7.2.8.

We will consider to upgrade the versions or to check the combination of Splunk Enterprise, MLTK, and Python

Re: object has no attribute 'wasserstein_distance'

DeanS1 — Tue, 11 May 2021 08:21:58 GMT

@tscroggins: Thank you. It works now. We have updated to PSC 1.4 - density fit is supported form this version on.

topic Re: object has no attribute 'wasserstein_distance' in Reporting

object has no attribute 'wasserstein_distance'

Re: object has no attribute 'wasserstein_distance'

Re: object has no attribute 'wasserstein_distance'

Re: object has no attribute 'wasserstein_distance'