Hey there, Results of the | fit command are affected by the time range picker.  Once you set the time range to all time, _time is displayed normally.   Edit: I looked into the interaction between inputlookup + fit + time range picker. As documented here, the result of the fit command are appended to the initial dataset. In this case, the expected outcome would be that the resulting table includes only rows that are covered by the time range picker. However, the following happens: Time range picker: All time Resulting table: Initial dataset + output of fit command Result: OK, expected result Time range picker: Some time before the first observation - now Resulting table: Initial dataset + output of fit command Result: OK, expected result (Warning: The specified span would result in too many (>50000) rows.) Time range picker: About halfway through the dataset timestamps - now Resulting table: Initial dataset + output of fit command Result: OK, unexpected result (Warning: The specified span would result in too many (>50000) rows.) Time range picker: After some time of the last observation - now Resulting table: Initial dataset + output of fit command Result: OK, unexpected result (Warning: The specified span would result in too many (>50000) rows.) Time range picker: Some time before the first observation - some time stamp after the last observation Resulting table: output of fit command Result: NOT OK, unexpected result I checked the sources that were available to me (search.log, .py files) but sadly this did not suffice to reverse engineer how the initial dataset and the output of the fit command are merged and filtered. It seems that earliest has no effect, but once latest is set to a timestamp, the behavior becomes unexpected. ... View more

Hey there, Have you tried pulling the docker image manually or did you just hit START? If not, try this:   1. SSH into your Splunk server 2. Check what docker images are present   docker images​   3. Pull the latest version of Golden Image CPU image manually from Docker Hub. As of today, its version 5.1.2     docker pull phdrieger/mltk-container-golden-cpu:5.1.2​   4. The image you just pulled should now be visible     docker images​   5. Update the DSDL app to the latest version. As of today, this is 5.1.2 6. Restart or refresh your search head 7. Now try to start the container again     In case you want any other docker image, here is the official repository where you find all images to every container image that is available in DSDL: https://hub.docker.com/u/phdrieger Let me know if I can help you any further.  ... View more

Hey Betty Have you pulled the docker container image (Golden Image CPU) manually or did you just select it from the dropdown and then hit START? If you did not pull it manually yet, try this first. SSH into the server where Splunk is installed Check what docker images are present. I suspect you don't see the docker image phdrieger/mltk-container-golden-cpu yet. This is needet to start a container.   docker images   Pull the latest version (as of today, 5.1.2) of the Golden Image CPU from Docker Hub   docker pull phdrieger/mltk-container-golden-cpu​:5.1.2   You should now see the image you just pulled   docker images​   OPTIONAL STEP: Check if you can start the container you just pulled   docker run phdrieger/mltk-container-golden-cpu​:5.1.2   Update the DSDL app to the latest version (as of today, 5.1.2) Restart or refresh your search head to make sure the news configs of DSDL 5.1.2 are live   http://YOURHOST:8000/en-GB/debug/refresh​   Now try starting a container again.   Here are all available docker images in case you want to pull others too: https://hub.docker.com/u/phdrieger    Let me know if I can help you any further. ... View more

Hey there, My guess is that you built a custom model in the jupyter lab environment where you also installed the keras package and imported the preprocessing functionality (from keras import preprocessing). You can probably fit and apply your model just fine inside the jupyter lab. The problem is, however, that once you want to fit and apply the model over in Splunk SPL, you get the error you described. Before you do anything else, make sure that the keras package is imported in the correct cell of your jupyter notebook. The package MUST be imported in the correct cell. If you started from the barebone_template.ipynb, this is the cell: You can check if you import packages in the correct cell by navigating to /app/model/your_notebook.py and check whether the keras package is imported. This is the file that will be used once you issue the | fit or | apply command over in Splunk. Here an example of how the .py file from the barebone_template.ipynb looks like:   If this did resolve your issue, great. If not, keep on reading. The docker container image you use, must have the keras library installed, otherwise the library is not available through the | fit and | apply command in Splunk SPL. Try resolving your issue by either ... ... using the pre-built 'Transformers CPU (5.1.1)' container image ... using the pre-built 'Transformers GPU (5.1.1)' container image ... build your own docker image as described here Make sure to update your DSDL app to the latest version in order to have these pre-built container images available. Let me know if I can help you any further. ... View more

Hey there, Your post is a couple months old, but since I stumbled into the same issue, I figured there will be more Splunkers in the future that encounter the same challenge and would appreciate if the solution is documented somewhere. The first part of my response lays out how to resolve the issue, in the second part I talk about why the issue arises in the first place. Part 1 - How to resolve the issue Apps > DSDL App > Configuration > Setup > Check the "Yes" box > Scroll to the "Splunk Access in Jupyter (optioinal)" section > Use the following settings: Enable Splunk Access: Yes Splunk Access Token: Paste your token here. If you dont have one, you can spawn a token under Settings > Tokens. Splunk Host Address: Paste your host address here (in my case it has this format: 123.456.78.90) Splunk Management Port: 8089 (This is the default, if you did not change it, you can use 8089) Press "Test & Save" Apps > DSDL App > Configuration > Containers > Start your container. If your container was already running, stop it and restart it Apps > DSDL App > Configuration > Containers > Press the "JUPYTER LAB" button Now open the "barebone_template.ipynb" in the /notebooks folder Execute the code that pulls data from Splunk. Now it should work just fine. import libs.SplunkSearch as SplunkSearch search = SplunkSearch.SplunkSearch()   Part 2 - More details in case you are curious Execute the following code in your jupyter notebook. Here you can inspect all os variables.   import os os.environ     For us of interest are the following.   os.environ["splunk_access_host"] os.environ["splunk_access_port"] os.environ["splunk_access_token"]     If you haven't fixed the issue yet, os.environ["splunk_access_enabled"] should return "false". You most likely started the container before you made the settings as I described in part 1. These os.environ variables are important, since the function that lets you pull data from Splunk relies on them. The error in your screenshot "An error occurred: int() argument must be a sting, ..." stems from the fact that the SplunkSearch() function has no values for host/port/token.   import libs.SplunkSearch as SplunkSearch search = SplunkSearch.SplunkSearch()     You find the source code for the SplunkSearch function in your Jupyter Lab here: /notebooks/libs/SplunkSearch.py. Somewhere in the upper section of this Python code, you see the following.   if "splunk_access_enabled" in os.environ: access_enabled = os.environ["splunk_access_enabled"] if access_enabled=="1": self.host = os.environ["splunk_access_host"] self.port = os.environ["splunk_access_port"] self.token = os.environ["splunk_access_token"]   As you can see in the code above, the SplunkSearch.py reads the host, port, and token you entered on the settings page if you also set Enable Splunk Access: Yes. If you are familiar with Splunk's REST API, you recognize that host, port, and token are necessary values to establish a connection from your notebook to Splunk to eventually retrieve search results for your query. I skip the details, but here are a couple lines from SplunkSearch.py that illustrate what packages are used, the connection that is made, as well as the search query that is initiated.   import splunklib.results as splunk_results import splunklib.client as splunk_client self._service = splunk_client.connect(host=self.host, port=self.port, token=self.token) # create a search job in splunk job = self.service.jobs.create( query_cleaned, earliest_time=earliest, latest_time=latest, adhoc_search_level="smart", search_mode="normal")     I hope this helps. Regards, Gabriel   ... View more

Hi Rick 😃 I edited the indexes.conf file by hand on the server, then restarted splunk. Running the command you suggested also shows that frozenTimePeriodInSecs is equivalent to what btool reports and is active in the runtime: runtime config ... View more

Your solution worked for me perfectly. Thanks! ... View more

I do realize this is an old post, however, I had the same issue of slight fluctuations in search results. During the course of examining this issue, I stumbled upon this yet unanswered question. In my search query, I use the perc() function. Its documentation says the following: The perc and upperperc functions give approximate values for the integer percentile requested. The approximation algorithm that is used, which is based on dynamic compression of a radix tree, provides a strict bound of the actual value for any percentile. This means, sometimes it might be perc50.3, in the next run perc49.6, etc. In my case, this was the cause for the fluctuations I observed. Once I swapped it for a function like avg(), search results were steady.     ... View more

I testet it yesterday and it turns out our production environment suppresses dashboards and reports that make use of the mapping command. I had to use subsearches after all. Thanks again for pointing me in the right direction, I am sure the mapping command will come in handy, at some point, even if I can't use it this time 🤓 ... View more

I just tried the mapping command. It did precisely what I needed. Thanks a lot, you saved me heaps of time! 💪 ... View more

Thanks for the hint! Tracking the files (by means of du) would then let me understand what makes up disk usage. ... View more

Hi @pdrieger_splunk I even tested that as well but must have done something wrong in the process. Thanks for your quick and detailed help, greatly appreciated! 🎉 ... View more

Hi @pdrieger_splunk First off, thanks for your reply 😃 1. Yes, I used pythons pickle library (import pickle). I appended pictures of the codes. 2. After I load the model, it seems to be exactly the same as before saving it. Also checkout the picktures appended. 3. Thanks for the heads up. I use DSDL for practicing purposes and kmeans due to it being relatively simple and unsupervised. 4. Am I right to assume reporting an issue here https://github.com/splunk/splunk-mltk-container-docker would be correct? ... View more