All Apps and Add-ons

MLTK: Why does API fail to interpret model name evaluated at query time "Error in 'apply' command: Invalid model name"?

csmartens
Explorer

Hi All,

I'm trying to apply several models in one query, and the model names themselves are evaluated from a subsearch so nothing ahead of the query is known about model names.  Building the list of model names has been solved, but passing them into the apply API is failing to be interpreted correctly.  A literal interpretation of the field holding the model name is dereferencing the field name itself.  

I can properly populate the model name if I use a dashboard token in the search query, where the token is simply being replaced with the contents of the token value before the query is sent to the search.  But this solution won't work outside of dashboards.  

Is there a trick I can use to force the replacement of an eval field to what the apply API sees?

The general solution below gives the error "Error in 'apply' command: Invalid model name "(matchstr)""

| eval models = "model1,model2"

| eval model=split(models,",")
| mvexpand model
| eval predicted_{model}="\"" + model + "\""
| stats values(*) as * by _time
| foreach predicted_*
[ apply(<<MATCHSTR>>) ]


Likewise setting a model name via eval below gives "Error in 'apply' command: Invalid model name "

(singleModel)""

| eval singleModel = "model1"

| apply(singleModel)
Labels (2)
Tags (1)
0 Karma
1 Solution

csmartens
Explorer

Foreach, and macros fail to properly set the model name, however MAP will work.  It is the only method I could use to get it to work:

| rest /servicesNS/-/-/data/lookup-table-files
| table author title
| where like(author, "%martens") AND like(title, "%mlspl%")
| eval title = replace(title, "__mlspl_", "")
| eval title = replace(title, ".csv", "")
| table title| map maxsearches=15 search="| savedsearch ApplyModelBySavedSearch modelName=$title$"

where the savedsearch 


| apply $modelName$
| rename "predicted(fieldToPredict)" as predicted:$modelName$

View solution in original post

0 Karma

csmartens
Explorer

Foreach, and macros fail to properly set the model name, however MAP will work.  It is the only method I could use to get it to work:

| rest /servicesNS/-/-/data/lookup-table-files
| table author title
| where like(author, "%martens") AND like(title, "%mlspl%")
| eval title = replace(title, "__mlspl_", "")
| eval title = replace(title, ".csv", "")
| table title| map maxsearches=15 search="| savedsearch ApplyModelBySavedSearch modelName=$title$"

where the savedsearch 


| apply $modelName$
| rename "predicted(fieldToPredict)" as predicted:$modelName$
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. I think you need to remove the parens () around model name.

Have a look here https://docs.splunk.com/Documentation/MLApp/5.2.0/User/Understandfitandapply

There are a few examples including 

...| apply temp_model
0 Karma

csmartens
Explorer

Good point to remove the parenthesis to match exact documented use, however the issue still exists after removing

Here's a few I've tried:

| eval singleModel = model1
| apply singleModel

| eval singleModel = "model1"
| apply singleModel

| eval singleModel = tostring("model1")
| apply singleModel

| eval singleModel = "model1"
| apply $singleModel

| apply
  [| eval r = "model1"
  | return $r
  | format]

lastly making a macro
| eval singleModel = "model1"
`applyPredictionWithModel(singleModel)`
where applyPredictionWithModel is
| foreach $mlfield$ [ apply '<<FIELD>>' ]

and just because I sometimes get the ticks confused I also
| eval singleModel = "model1"
`applyPredictionWithModel(singleModel)`
where applyPredictionWithModel is
| foreach $mlfield$ [ apply <<FIELD>> ]
Both returning Error in 'apply' command: Failed to load model "field": Model does not exist.



I can't seem to sneak past getting the characters after "apply" to be anything but a literal interpretation.

0 Karma

burwell
SplunkTrust
SplunkTrust

I haven't done MLTK for a year but i did write some macros.

I had a macro with model name and  I used...

... | apply "$model_name$"

 

0 Karma

csmartens
Explorer

Was the value passed in $model_name$ from a field, or simply the hardcoded model name?

ie 

`burwellMacro(mlmodel1)`

or

| eval myfieldwithmodelbname = "mlmodel1"
`burwellMacro(myfieldwithmodelbname)`

0 Karma

burwell
SplunkTrust
SplunkTrust

I used `burwellMacro(mlmodel1)`

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...