Splunk Search

fit command in MLTK detecting categorial outliers

Janani_Krish
Path Finder

Hi,

I tried the below query to fit my model,

sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command| fit DensityFunction count by "device_name,command,user_name" into mymodel threashold=0.05 dist=norm

I am getting the following error,

Error in 'fit' command: Error while initializing algorithm "DensityFunction": Algorithm "DensityFunction" cannot be loaded

I have tried with LocalOutlierFactor algorithm too but getting the same error.

Please suggest.

Labels (1)

thambisetty
SplunkTrust
SplunkTrust

are you running it in Indexer cluster?

are you able to run examples from ML toolkit?

can you check if DensityFunction available in your ML Toolkit on search head. you can check in settings of ML ToolKit.

————————————
If this helps, give a like below.

Janani_Krish
Path Finder

Yes The issue is I am using version 3.4 where only OneClassSVM algorithm is supported.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

there are many improvements in latest version of ML Toolkit. I advise you to upgrade it to latest version.

————————————
If this helps, give a like below.

thambisetty
SplunkTrust
SplunkTrust

sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command| fit DensityFunction count by "device_name,command,user_name" into mymodel threashold=0.05 dist=norm

  1. user_name used in by clause is not available in results because you have not renamed values(user_name) as user_name. 
  2. I advice you to understand how to identify features for ML algorithms. right features are very important to get more accuracy.

https://en.wikipedia.org/wiki/Feature_engineering#:~:text=Feature%20engineering%20is%20the%20process....

https://towardsdatascience.com/feature-engineering-for-machine-learning-3a5e293a5114?gi=3ea8b5b00f7d

 

————————————
If this helps, give a like below.

Janani_Krish
Path Finder

Hello @thambisetty 

Yes I agree with your features part which will give us the fine ML model.

But before diving into data set tuning  I just wanted to check if it is giving any results as below,

sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command| fit DensityFunction count by "device_name,command" into mymodel

I have removed the user_name part mentioned earlier.But still I am facing the same error as below,

Error in 'fit' command: Error while initializing algorithm "DensityFunction": Algorithm "DensityFunction" cannot be loaded

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...