Machine Learning Toolkit: Is there a maximum number of events that the app is able to handle?

[ryanprayacn]

Is there a maximum number of events (e.g. 500,000) that the Machine Learning Toolkit (MLTK) capable of handling? Trying to ingest 7M events, seems to cut off at 500k.

[aoliner_splunk]

Hi ryanprayacn,

There are no hard limits, but there are configureable resource limits defined in the following conf file:
Splunk_ML_Toolkit/default/mlspl.conf

Because MLTK fits models on the search head, we give customers the ability to control these limits via the file above, with reasonable defaults.

As an aside, you should consider whether you really want to fit on that many events. Linear regression, for example, is unlikely to yield significantly different results on 7M events compared with, say, 500k random events. Depends on your data and application, of course. 🙂

Does this answer your question?

Cheers,
- Adam

[gouravdashtcs]

Hi,
There is no limit to the events that can be ingested to Splunk. However there is a limit to indexing to data, it depends on the Liscence type which you are having or using. For a free Liscence you can invest 5gb of data per day.
Moreover there is no limit for the no of events in an App in splunk. App in splunk is just a cluster of custom reports and dashboards. Events are stored in indexes. You can create index for particular data source, also you can mention the size of the index at the time of creating it.

Hope you find it useful!

[ryanprayacn]

This is for the Detect Numeric Outliers capability.