All Apps and Add-ons

Problem with MLTK to run a model

celianouguier
Explorer

Hi everyone,

I'm annoyed because I use the MLTK machine learning module to predict the score of one of my applications (using ITSI data).

For that I execute a request , I make a simple standardcalculation with a number of variables, then I run the model on my variables with standardcalculation and some other qualitative variables.

The model runs well and is saved.

When I then want to apply this model with the commands:

| apply Healthscore_Application_DB_StandardScaler_0 
| apply Healthscore_Application_DB

I have the following error

Error in 'apply' command: No valid events; check for null or non-numeric values in numeric fields

I don't understand why because I have this error also when I use exactly the same query as for learning. So there are necessarily valid events.

If anyone can help me, I'll be grateful.

0 Karma

astein_splunk
Splunk Employee
Splunk Employee

That error comes from Fit and Apply's data cleaning under the covers, check out https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Understandfitandapply

when you do a |summary for the models can you see a completed model ?
When you build the models, are the permissions correctly set to use those models in another app (I think you are using ITSI for example) . https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Models

Have you checked out the MLTK FAQ page for more guidance?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...