Splunk Search

fit command in MLTK detecting categorial outliers

Janani_Krish
Path Finder

Hi,

I tried the below query to fit my model,

sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command| fit DensityFunction count by "device_name,command,user_name" into mymodel threashold=0.05 dist=norm

I am getting the following error,

Error in 'fit' command: Error while initializing algorithm "DensityFunction": Algorithm "DensityFunction" cannot be loaded

I have tried with LocalOutlierFactor algorithm too but getting the same error.

Please suggest.

Labels (1)

thambisetty
SplunkTrust
SplunkTrust

are you running it in Indexer cluster?

are you able to run examples from ML toolkit?

can you check if DensityFunction available in your ML Toolkit on search head. you can check in settings of ML ToolKit.

————————————
If this helps, give a like below.

Janani_Krish
Path Finder

Yes The issue is I am using version 3.4 where only OneClassSVM algorithm is supported.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

there are many improvements in latest version of ML Toolkit. I advise you to upgrade it to latest version.

————————————
If this helps, give a like below.

thambisetty
SplunkTrust
SplunkTrust

sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command| fit DensityFunction count by "device_name,command,user_name" into mymodel threashold=0.05 dist=norm

  1. user_name used in by clause is not available in results because you have not renamed values(user_name) as user_name. 
  2. I advice you to understand how to identify features for ML algorithms. right features are very important to get more accuracy.

https://en.wikipedia.org/wiki/Feature_engineering#:~:text=Feature%20engineering%20is%20the%20process....

https://towardsdatascience.com/feature-engineering-for-machine-learning-3a5e293a5114?gi=3ea8b5b00f7d

 

————————————
If this helps, give a like below.

Janani_Krish
Path Finder

Hello @thambisetty 

Yes I agree with your features part which will give us the fine ML model.

But before diving into data set tuning  I just wanted to check if it is giving any results as below,

sourcetype=files command="*cmd.exe*" earliest=-90d@d latest=-1d@d|stats count values(file_path) values(user_name) values(action) by device_name,command| fit DensityFunction count by "device_name,command" into mymodel

I have removed the user_name part mentioned earlier.But still I am facing the same error as below,

Error in 'fit' command: Error while initializing algorithm "DensityFunction": Algorithm "DensityFunction" cannot be loaded

Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...