Looking at that error I would recommend reviewing if the roles that need the ability to list machine learning models have the list_models capability. Solution: You must have thelist_models capability turned on to view available machine learning models when you upgrade to AITK version 6.0.2. The Audit - MLTK models saved search is configured to run under the admin namespace, so you must turn on the list_models capability for the admin user. Troubleshoot upgrading AI Toolkit in Splunk Enterprise Security | Platform (last updated 2026-09-01T21:10:07.613Z) ... View more