Outliers Viz not loading

[guimilare]

Hello Splunkers.

I've downloaded the Splunk Machine Learning Toolkit.
In Detect Numeric Outliers Showcase, I can successfully create a search, detect the outliers and see the "Data and outliers" graph.
However, when I try to do this in another dashboard (or even inside the Search dashboard in the Machine Learning App), I get the following error:

Failed to load source for Outliers Chart visualization.

Any ideas why I can't load the viz?

Regards, GMA

[niketn · Accepted solution]

Click on left top Apps > Manage Apps and then select the Sharing Permissions for Splunk Machine Learning Toolkit and change from This App Only (system) to All Apps

Refer to one of my previous answers: https://answers.splunk.com/answers/619921/not-able-to-access-dashboard.html

[guimilare]

Hi niketnilay,

Yes, I've done it already, but no luck.
Actually, the viz only works inside the Showcase dashboard.

If click "Open in Search", the viz fails to load.

[niketn]

@guimilare, for the Outliers Chart visualization to work you would also need the final table to have the following table format

_time, <outlier_variable>, <lower_bound>, <upper_bound>

When you are running your search outside of Machine Learning Toolkit App, have you checked to ensure that you are getting field values for all above fields? (I mean besides Making Machine Learning App available as Global, is the index containing data for prediction also searchable in the app for the logged in user?

When you get the error in Outlier chart, can you hit F12 and under Console Errors see what are the error details:

If you see an error like the following, it implies expected fields for the visualization are not present.

VisualizationError
message
:
"One or more fields is missing. Expected fields are _time, <outlier_variable>, <lower_bound>, <upper_bound>."

If one of this does not help, please add the detail of Your Splunk Version, MLTK version, Python for Scientific Computing version details. Also the current search and Tablular Output of the search if possible.

I tried on Splunk 7.1 with MLTK 3.2.0 and Python for Scientific Computing for Windows 64 bit and it worked fine!

[guimilare]

Hi, niketnilay,

after upgrading splunk to version 7.1, I was able to use Outliers Chart.

Thanks.

[niketn]

Glad you got it to work... do accept the answer and upvote the comments that helped 🙂