All Apps and Add-ons

How do you feed data from an existing Splunk data model into the Splunk Machine Learning Toolkit?

collinlorb
Engager

With the ML tool kit, I see that you can | inputlookup data from a .CSV file. But what if you want to pull from tables that have data changing continuously?

We have data models in Splunk with the data I am looking for, but I can't find the correct method, or syntax, for bringing it into the ML tool kit.

Any insight would be greatly appreciated.

Thanks,

0 Karma

aoliner_splunk
Splunk Employee
Splunk Employee

Any data that can be retrieved by a Splunk search can be used with the ML Toolkit, including data from indexes or third-party data sources like Hadoop (with Splunk Hadoop Connect). You simply append that search with the applicable | fit ... or | apply ...

0 Karma

collinlorb
Engager

In the MLTK, how do I search for data that is located in a data model, inside of Splunk Datasets?

0 Karma

aoliner_splunk
Splunk Employee
Splunk Employee

The same way you search for data in a Data Model anywhere else in Splunk. For example:
| datamodel network_traffic search | search tag=destination

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

Hey Collin,

If I understand your question correctly, you are running search through inputlookup command on searchbar.

| inputlookup in showcase is just for example purpose for new users. Replace it with actual search using index or data model. Once you are done with creating models, schedule a training for regularly updating model on new incoming data.

collinlorb
Engager

I was using | inputlookup to bring in .csv files for experimentation. How do I search for data that is already in the data model inside of Splunk Datasets?

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

In the assistant , you can see the raw data preview if you scroll down or you can do it in search tab and bring that SPL to assistant.

0 Karma

collinlorb
Engager

Yes this what I needed to do. Essentially | From

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

if it has solved your query, please mark it as accepted answer.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...