Optimize the hyperparameters in an automated way is not something supported out of the box, but if your Splunk instance is a separate node and you won't impact production servers you can write your own optimization via the ML APIs by creating a clone of the algorithm and inserting the technique of your choice. Check out https://docs.splunk.com/Documentation/MLApp/4.2.0/API/Overview or the Github for more examples. I would not try to do so with an |apply step, which you seem to be hinting at, but partial_fit might be an option. ... View more

Hi! We do not expose these settings as the MLTK exposes machine learning as a first class citizen in Splunk's SPL paradigm and tries to stay true to SPL common behaviors. Splunk's SPL commands do not expose multithreaded options - all of that is abstracted by the SPL system. As the ML SPL commands (fit and apply) in the MLTK for the most part use only the search head resources, we want to be cognizant of the other potential production workloads on the shared Splunk infrastructure. If you are looking for massive scale machine learning I suggest looking at the Splunk MLTK Connector for Apache Spark (via Splunk beta) or the Splunk MLTK Container for TensorFlow (via PS) - both of which are leveraging non Splunk infrastructure for those large machine learning workflows. ... View more

Can you share your search? I suspect you need to ...|lookup nameofclookup.csv ...OUTPUTNEW... like any spl search ... View more

Hi "In our current situation, the raw metadata of the extracted features cannot be streamed in realtime to Splunk but has to be uploaded manually one a week." Why is this? Most of the customers I work with can extract their features from the streaming data in Splunk, which are used in the training of the model (|fit) . Can you elaborate? If you go through the SDK/API documentation for Splunk, you can submit a search to splunk and get the results back from an external system. An example search can be making an empty result set (makeresults) , filling the correct fields with features (|eval) and then applying the ML model to get the result back (|apply). ... View more

I think you are asking for the following? The Numeric Outlier Detector, as of 2.1, does not store a model file for the statistical observations used to score anomalies. You can store the values from a previous search (a priori) by using | outputlookup MyNewModelFile.csv and then | inputlookup in a real time search to enrich the new events with the observed values. Using your specific example, I would 1) click the open in search button , copying the search to a new splunk window for editing 2) edit to look like | inputlookup hostperf.csv | eval _time=strptime(_time, "%Y-%m-%dT%H:%M:%S.%3Q%z") | timechart span=10m max(rtmax) as responsetime | head 1000 | eventstats median("responsetime") as median | eval absDev=(abs('responsetime'-median)) | eventstats median(absDev) as medianAbsDev | outputlookup MySavedModel.csv 2) the | outputlookup MySavedModel.csv , perhaps remove the |head 1000 section as needed. The point of MySavedModel.csv is you are storing the anomaly levels as detected by every scheduled run over a long time window and then scoring alerts based on a smaller time window "real time" search. 3) save the search as a report that runs in the background and updates itself every N minutes as needed 4) use inputlookup (with a time join) for MySavedModel.csv to enrich the new data as it comes in and make a eval/alert. the new search will use the | eval isOutlier=if('responsetime' < lowerBound OR 'responsetime' > upperBound, 1, 0) using the old lowerBound,upperBound from the observed time and you can save the alert as the isOutlier bit. ... View more

Hello There isn't an app to date that has a pre built TensorFlow connector. Several customers are using our Rest Api to work with TensorFlow. Can you tell me more about the use case? ... View more

...Spaces. The original key was "Splunk dashboards-86e3193df54c.json" download from the instructions listed. I followed all the steps, including the addition notes on how to manually configure . Nothing worked. In a fit of laziness I renamed the keyfile locally as "Splunkdashboards-86e3193df54c.json" to make my autocomplete linux command lines smooth, and everything magically works. Thank you. ... View more