How do you feed data from an existing Splunk data model into the Splunk Machine Learning Toolkit?

[collinlorb]

With the ML tool kit, I see that you can | inputlookup data from a .CSV file. But what if you want to pull from tables that have data changing continuously?

We have data models in Splunk with the data I am looking for, but I can't find the correct method, or syntax, for bringing it into the ML tool kit.

Any insight would be greatly appreciated.

Thanks,

[aoliner_splunk]

Any data that can be retrieved by a Splunk search can be used with the ML Toolkit, including data from indexes or third-party data sources like Hadoop (with Splunk Hadoop Connect). You simply append that search with the applicable | fit ... or | apply ...

[collinlorb]

In the MLTK, how do I search for data that is located in a data model, inside of Splunk Datasets?

[aoliner_splunk]

The same way you search for data in a Data Model anywhere else in Splunk. For example:
| datamodel network_traffic search | search tag=destination

[grana_splunk]

Hey Collin,

If I understand your question correctly, you are running search through inputlookup command on searchbar.

| inputlookup in showcase is just for example purpose for new users. Replace it with actual search using index or data model. Once you are done with creating models, schedule a training for regularly updating model on new incoming data.

[collinlorb]

I was using | inputlookup to bring in .csv files for experimentation. How do I search for data that is already in the data model inside of Splunk Datasets?

[grana_splunk]

In the assistant , you can see the raw data preview if you scroll down or you can do it in search tab and bring that SPL to assistant.

[collinlorb]

Yes this what I needed to do. Essentially | From

[grana_splunk]

if it has solved your query, please mark it as accepted answer.