All Apps and Add-ons

How do you feed data from an existing Splunk data model into the Splunk Machine Learning Toolkit?

collinlorb
Engager

With the ML tool kit, I see that you can | inputlookup data from a .CSV file. But what if you want to pull from tables that have data changing continuously?

We have data models in Splunk with the data I am looking for, but I can't find the correct method, or syntax, for bringing it into the ML tool kit.

Any insight would be greatly appreciated.

Thanks,

0 Karma

aoliner_splunk
Splunk Employee
Splunk Employee

Any data that can be retrieved by a Splunk search can be used with the ML Toolkit, including data from indexes or third-party data sources like Hadoop (with Splunk Hadoop Connect). You simply append that search with the applicable | fit ... or | apply ...

0 Karma

collinlorb
Engager

In the MLTK, how do I search for data that is located in a data model, inside of Splunk Datasets?

0 Karma

aoliner_splunk
Splunk Employee
Splunk Employee

The same way you search for data in a Data Model anywhere else in Splunk. For example:
| datamodel network_traffic search | search tag=destination

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

Hey Collin,

If I understand your question correctly, you are running search through inputlookup command on searchbar.

| inputlookup in showcase is just for example purpose for new users. Replace it with actual search using index or data model. Once you are done with creating models, schedule a training for regularly updating model on new incoming data.

collinlorb
Engager

I was using | inputlookup to bring in .csv files for experimentation. How do I search for data that is already in the data model inside of Splunk Datasets?

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

In the assistant , you can see the raw data preview if you scroll down or you can do it in search tab and bring that SPL to assistant.

0 Karma

collinlorb
Engager

Yes this what I needed to do. Essentially | From

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

if it has solved your query, please mark it as accepted answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...