All Apps and Add-ons

Machine Learning Toolkit: Is there a maximum number of events that the app is able to handle?


Is there a maximum number of events (e.g. 500,000) that the Machine Learning Toolkit (MLTK) capable of handling? Trying to ingest 7M events, seems to cut off at 500k.

0 Karma

Splunk Employee
Splunk Employee

Hi ryanprayacn,

There are no hard limits, but there are configureable resource limits defined in the following conf file:

Because MLTK fits models on the search head, we give customers the ability to control these limits via the file above, with reasonable defaults.

As an aside, you should consider whether you really want to fit on that many events. Linear regression, for example, is unlikely to yield significantly different results on 7M events compared with, say, 500k random events. Depends on your data and application, of course. 🙂

Does this answer your question?

- Adam


There is no limit to the events that can be ingested to Splunk. However there is a limit to indexing to data, it depends on the Liscence type which you are having or using. For a free Liscence you can invest 5gb of data per day.
Moreover there is no limit for the no of events in an App in splunk. App in splunk is just a cluster of custom reports and dashboards. Events are stored in indexes. You can create index for particular data source, also you can mention the size of the index at the time of creating it.

Hope you find it useful!

0 Karma


This is for the Detect Numeric Outliers capability.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...