Hi experts, I am in early experiment journey with Splunk App for DSDL (aka DLTK) to pull in some events into Jupyter note book by way of Option 2, i.e: <SPL search> | fit MLTKContainer mode=stage algo=my_test * into app:my_test_data where my_test is just cloned from barebone_template, and I want the input data file to be created with name of "my_test_data". I ran into following error since the SPL returns 500+ events: Input event count exceeds max_inputs for MLTKContainer (100000), model will be fit on a sample of events. To configure limits, use mlspl.conf or the "Settings" tab in the app navigation bar. Upon checking mlspl.confg and fair enough max_input is set as default 100,000. However, the resulting my_test_data.csv only contains 1153 lines and excluding the header row only 1152 of events of interest. Why don't I get 100,000 events into the csv file and it's not a disk space issue either having verified it. More importantly, how can I get the full 100,000 events into my csv file? Any advice is greatly appreciated. Thanks, MCW
... View more