Hi All,
I followed Ian's blog (https://blog.arcusdata.io/splunk-mltk-to-predict-kb-articles) and it is a nice blog.
But what I am missing: how to search (makeresult) in the model with a description like "Unsupported Java version". When performing a search with this text on the model, I think/expect "KB0020147" (or another KB number that fits better according the model) to be returned as result.
I suspect the search string looks like:
| makeresults | eval description="Unsupported Java version" | apply <ModelName> as Predicted_KB
But I think this won't work because the description needs to be prepared first to fit on the model values (PC_1, PC_2 and PC_3) which are numeric.
Does anyone has an idea how the search/makeresult string would look like?
Thanks.
Regards,
Madere
