Hello and Welcome to the School of Splunk,
Today, we are going to talk about What’s New in the Splunk Machine Learning Toolkit
Version 3.2
The Main features launched in the Machine Learning Toolkit 3.2 is the Experiment Management
Framework.
Experiment Management Framework(EMF) has brought in multiple changes, both backend, and frontend,
in the Machine Learning Toolkit (MLTK).
We will talk about some of the changes driven by EMF but first, let’s talk about why do
we need an experiment management framework for MLTK.
If you have used the Machine Learning Toolkit previously you would have noticed its key
features such as:
¥ MLTK makes it easier to create ML models using the guided user interface, known as
“assistants.”
¥ Some of these assistants also have the pre-processing options before the actual ML
model creation, and these pre-processing steps could produce additional models based on the
pre-processing algorithm used.
¥ Once we get the optimal model or result, it’s time to operationalize based on those
results via scheduling model runs, setting up alerts, sharing results, etc.
Previously, all these steps of pre-processing, creating models, managing models and operationalizing
based on their results, were separate and it wasn’t easy to know:
• which scheduler or alert is assigned to which model,
• which ML model has gone through a pre-processing step and which one has not,
• also filtering of models was missing.
Now, in the new framework, these concern have been answered, and all the relevant artifacts
(alerts, models, schedulers) are tied up together to form a unified entity, called “Experiment.”
As a result, one can maintain all the linked artifacts easily from a single page.
Now let’s have a quick demo run for EMF:
This is the first page for the MLTK, and you can see that now we have a new tab called
Experiments.
Once a user clicks on the Experiment option, we get the assistant selection page.
After selecting an assistant, we land on the usual assistant page where one can create
and validate their ML models using the guided user interface.
In this page, the notes sections before the fit model button and manage menu drop down
option on the top right section are the two new changes on the assistant page.
• Notes Section: Users can now add their comments with any changes made to the experiment,
this would help users maintain notes for their changes.
• Manage Drop Down: Using this menu one can change the title of the experiment or
delete the experiment.
This is the Experiment History tab which has replaced the previous Load Settings tab.
All the changes to any particular experiment could be traced on this tab along with the
name of the user, note and time of the change made.
You can also reload any of the previously saved experiment histories.
Once we save the Experiment, it gets registered in the main Experiments page.
In this page, the experiments are filtered based on the assistant it was built on.
Currently, we have one experiment for each type of assistant.
You can further narrow down to a specific experiment using the filter option.
One of the important changes in EMF is the Scheduling and Alerting option.
Previously, we could schedule and create an alert right from the assistant, but now we
have to schedule or create an alert from the main experiment page using the time and alarm
icon in the screenshot.
The alerting and scheduling interface remains the same.
You would also have an option to manage all the alerts created using MLTK with its trigger
conditions, trigger actions, status, the time when was it last triggered, etc.
As a whole, MLTK is now more of a pure production data-science application letting users build
and manage multiple machine learning experiments and show when those experiments ran, what
the results were upon operationalizing the experiments, etc.
This concludes our introduction to "What’s New in MLTK" video and we hope you found our
features interesting and useful.
If you have any questions, then please reach out to us on this mail id.
Thank You and Happy Splunking!