Check this out : https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#LocalOutlierFactor ... View more

Hi, Did you looked into MLTK new algorithm StateSpaceforecast which supports multivariate? Checkout the blog below for more information:https://www.splunk.com/blog/2019/03/20/what-s-new-in-the-splunk-machine-learning-toolkit-4-2.html Also, we have now new alerts for Machine learning which can be used in your usecase. Checkout the documentation on statespace forecast here : https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#StateSpaceForecast Thanks, ... View more

Great thanks. ... View more

Ensure the app namespace and user namespace is correct and please check the roles and permissions. for now alerting and then copying will do the job for you. ... View more

Hi, Did you get a chance to look into Score command Documentation? Let me know if this helps. https://docs.splunk.com/Documentation/MLApp/4.1.0/User/ScoreCommand ... View more

No its not SimpleObjectCodec problem. I know the reason behind it. Let me explain you When you are using GitHub algos, you can use it as an app . Instruction has been given in the readme file If you want to use it inside MLTK by copying the algo in Toolkit, please do the following Copy the algo file to $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/bin/algos Open the file and change line 64 as shown below Change : codecs_manager.add_codec('algos_contrib.CustomDecisionTreeClassifier', 'CustomDecisionTreeClassifier', SimpleObjectCodec) To : codecs_manager.add_codec('algos.CustomDecisionTreeClassifier', 'CustomDecisionTreeClassifier', SimpleObjectCodec) i.e you are replacing "algos_contrib" to "algos" -Make sure to register your algorithm under algos.conf -restart splunk and it will work for you 🙂 Here is the syntax to use class_weight | fit DecisionTreeClassifier class_weight="{'Yes':1,'No':0.1}" ... View more

Let me step back and start from your first question: Predict command != Predictions Predict command only does forecasting using different modes of Kalman filter on a single value over time It does not create or save models Currently you cannot do this with predict command and everytime you have to run the entire search to do the forecasting ... View more

You can use this as reference for adding class weight in your algo or you can use Github algo directly for your case: https://github.com/splunk/mltk-algo-contrib/blob/master/src/bin/algos_contrib/CustomDecisionTreeClassifier.py ... View more

if it has solved your query, please mark it as accepted answer. ... View more

In the assistant , you can see the raw data preview if you scroll down or you can do it in search tab and bring that SPL to assistant. ... View more

Checkout the predict documentation here : http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Predict It has all the options of predict command with examples ... View more

Can you check the mlspl.log? Its under $SPLUNK_HOME/var/log/splunk and share the error message here. ... View more

Hey Collin, If I understand your question correctly, you are running search through inputlookup command on searchbar. | inputlookup in showcase is just for example purpose for new users. Replace it with actual search using index or data model. Once you are done with creating models, schedule a training for regularly updating model on new incoming data. ... View more

Open mlspl.conf file under $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/default/mlspl.conf or $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/local/mlspl.conf and check if streamily apply has been set to true or not. Also, if you have upgraded the setup and streaming apply is true., Please upgrade PSC on all your indexers. ... View more

Is it a distributed or Search head cluster setup? Are you using streaming apply on all the indexers?? If yes, did you upgraded PSC on all the indexers? You need to recreate your model after upgrading PSC version. ... View more

You need to save your experiments before creating an alert or scheduling a training on experiment. Steps would be : - Save your experiment - It will take you to a listing page - You can click on Manage button to create alerts or schedule trainings on experiments as shown below ... View more

Additionally you can login to your cloud instance and Go to Apps--> Manage Apps--> Click on Browse more apps and Enter "scientific" in the search bar You will see Python for scientific app and MLTK on the right hand side. Go ahead and install it through your splunkbase account ... View more

Is it a free trial version cloud instance? How did you install MLTK on cloud instance? How do you know your cloud instance is windows machine? Contact support to install PSC on your cloud instance Or you can also search for python scientific app on Manage app page Can you share the Splunk version info? ... View more

Hi, You can download and install Python scientific app for windows (on premise) from following location https://splunkbase.splunk.com/app/2883/ The other way to install the PSC would be to go to Splunk Manage App setting and search for python scientific app windows version and install it by logging into your splunkbase account ... View more

Hi, You need to specify eps=0.3 instead of eps=radius as eps accepts only numeric value http://docs.splunk.com/Documentation/MLApp/2.3.0/User/Algorithms#DBSCAN Let me know if this solves your issue. Thanks, ... View more

Hi Rahul, Please check your Manage app settings to check if PSC has been installed successfully or not Have you installed Splunk ML Toolkit? Try our new release : http://docs.splunk.com/Documentation/MLApp/2.2.0/User/Whatsnew Download it from here : https://splunkbase.splunk.com/app/2890/ Thanks ... View more