Splunk Search

How to Dynamically save model name using a column value?

bhavesh0124
Explorer

Hi I have the following query for training a model. However, I want to save my model name using a single column value that comes from a lookup. In a nutshell, I want to save the model name dynamically.


index = "Abc" 
fields Days, Count, Target
| sample partitions=100
| appendpipe
[ | search partition_number < 90 | fields - partition_number
| fit DecisionTreeRegressor "target" from * splitter=best into "model_name" apply=false ]

So currently the model name is "model_name" but I want it to come from a lookup, where there is single column and a single value. 


@niketn  @gcusello 


Labels (3)
0 Karma

bhavesh0124
Explorer

That worked! Thanks a lot

0 Karma

etoombs
Path Finder

I've never tried to make a model name dynamically,  but have done it with outputlookup - maybe you can do something similar?

| outputlookup
[| makeresults
| eval filename=strftime(relative_time(relative_time(now(),"-1mon@mon"), "@m"), "filename_%B_%Y.csv")
| return $filename]

Something like:

[ | search partition_number < 90 | fields - partition_number
| fit DecisionTreeRegressor "target" from * splitter=best into [|inputlookup xyz output myfieldname|return $myfilename] apply=false ]

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...