Here we have a new copy of spunk installed with machine learning toolkit and
the supporting app for Python for scientific computing. Let's launch the
machine learning toolkit and explore some of the pre-populated use cases
through the modeling assistance. When you start the machine learning toolkit app
it takes you to the showcase first. One of the first features is the tour that
will actually take you through the assets while the tour will launch the
first time you run the app if you want to run it afterwards you can just
initiate it with ? button at the upper right hand corner and actually go
through the tour, we are going to skip it. Here along the top you also have access
to our video tutorials for each of the different stories today I'm going to
take you through one. The documentation for the most modern version of the
application is available here and on our docs page and finally we have the
assistance and the schedule job, the dropdowns, which will actually be a kind of a
summary view that we're gonna go a little bit later. But first let's go
through with the Showcase is really about the Showcase is organized around
the modeling assistants, each modeling assistant gives a guided machine
learning experience, for instance predicting numeric fields right here and I'm
going to go to the very first story predicting server power consumption but
first just one more thing about the assistance you actually can see there's
a paragraph following each one of the assistant links right here which
actually describes with the high-level use case is and then we have the stories
it's themselves populated below
let's go to predicting server power consumption. So this is an assistant
it's a guided machine-learning tour at the top we have some sort of slug search
in this case it's just a CSV look up that could be any splunk search that you
could possibly want to do you plug it right in there, and down here at the
bottom after you've done your search , down here, right below it we have
the ability to select different algorithms to solve the high-level
problem predicting numeric fields each one of these algorithms here predict
some sort of numeric field for every event that you've loaded into the search
bar, up here
select the target for that algorithm and you can select which fields, in an interactive
manner right
select which fields want to have contribute to predicting that numeric
field that's the target of the algorithm and finally you can you can split your data
and training & test.And this is really about creating a ball for the training
set of data and validating on the test set
fifty-fifty is is just kind of the default value of most of the data
science I know try do more like a 70/30 so you train your data on seventy percent
of the data and then test it on thirty percent, well last thirty percent in this
case. The different algorithms have a lot of other options
I'm not gonna I'm not gonna go through all the options here you can see they
they show up here along the bottom they're all in the documentation right
but that's also going to be something that you need to go and actually you
know research on your own which which is the correct algorithm to use for
each of the different possible sub cases of predicting. Our default linear
regression works for all of our stories here and it's a good starting out there
is a good place to begin your journey, so after you select your algorithm a few
selected your fields etc, one of the options here to save the model as a
name and this is important because this name is going to be used by the rest of
your searches to apply that model in the future or to update that model in the
future and this field here creates a permanent look up, permanent until you
actually delete it right like everything in the world, permanent look up that you
apply to the rest of your searches and you can actually see some of the
previous models that have been running on this machine. I got the various
settings and the model itself as well as the ability to remove it from history
when the model was created
what was the original search query what was the algorithm where my various
settings that i may have set for that algorithm and finally what was the what
was the targeted field and what what fields that I used to actually make that
prediction.
I mean all these different values help you keep track of what models you have
stored on your machine by the assistance and you can delete them you can add them
etc as you see fit
back in the create model workflow we've got the ability to
fit a model right now that's gonna go out and run an algorithm on the
parameters that i selected appear on the on the data on these fields etc
where I can schedule the fit by clicking on this button, right there. You'll notice that
we have these tooltips. These tooltips should show up and guide you through
whatever step you're considering at the time and this tool tips are there to really
give you a sense of what you're doing with the different fields. I am just
following them and then looking at them.
Finally we have the ability of course to open anything in splunk as a search right
because everything in splunk, is a search. You can even show just the SPL and kind
of a high-level view here very quickly you can see that the search here at the
top and then the assistant has written the rest of the SPL the rest of our
search processing language that's required to run that linear regression
for you and that's actually one of my favorite features about this assistance
actually all the assistance, is that they write SPL for you after you've
interacted with the algorithm and kind of an interactive way and you've made
your selections you know it's really helping you get to a search that's going
to bring you value quicker right. As we continue down the page we got the
preview of the data you can see the preview the data has some of the fields
we've come to know and love from the above selections AC power , some features
but there's two new features, there are two new fields here. They are
predicted AC power and the residual residual is the difference between the
predicted value and the actual value for each event and the predicted AC power is
the output of that model being applied to this data right here just as a
continuous stream right so we can see that in Splunk as well you can open it as
a search in another window and see the SPL right here, we've evaluated with residual
i was mentioning before, here's that apply part that i just mentioned this
part of the language that we're extending and creating through the
machine learning toolkit apply a model right as opposed to when we fit a model
fit an algorithm to create a model
from a bunch of fields and the system continues from here actually showing you
the various graphics or mod viz, we call them mod viz , but they are
graphics to show you in an interactive way you know how that model
is doing , what is the effect of that model through time right
compared to the actual field that you're trying to predict what's the scatter plot
for the the individual points that you're trying to map to a single line
going through all those points that's definition of linear regression and what the
residuals look like what is the residual histogram etc and each one of these is
a visualization that you can show the SPL for right or you can actually
open in a search just like everything else in the assistants, it's there for your
reuse in your own dashboards in your reports etc and one of things I sort of
jumped over here was the scheduling and alert, which actually brings up a nice
way for you to set an alert directly in the machine learning toolkit
as opposed to in another search, you can do it right here and you can set the
alert for whatever the predicted value is greater than or less than or what
have you.
Once you've created that alert you know that will be running in the background
looking for when that value is true and you can go in and edit what
that looks should do should send an email should do SMS text should it
should go get your attention in another way just like any other alert in splunk
it's a search in the background with a bunch of options you just put it made it
available here in the
Machine Learning toolkit. At the very bottom we have sort of a summary of how
that particular model is doing we have the r-squared statistic which is a good
measure of fit.
How good is our overall model at fitting all the data points in our selection
right and again everything here is available and SPL you can open it up.
Here are the coefficients for the various features that you've selected to feed into that
model and that's the assistant, you know it gives you this high-level
ability to see the entire model right from its creation, you can fit it
, you can then see it applied to your test data,you can see what its gonna look like out in
the real world and then you can take that model and
use it in another search you can click here you're open search here and it's
already reaching out and grabbing some new data,in this case it is driving that CSV
it's applying that named field right, to all of your data
here's the output of that model right there, so I am gonna go back to the showcase. Want to take a
moment to describe what's going on here in the background we've got Python for
scientific computing and wrapped some of the algorithms, 27 of the algorithms for
your use in this interactive command interface you notice this fit the supply
these are these assistance with the drop-down you can select these 27
algorithms.Depending on that use case, whether you're predicting
category fields or clustering numeric the algorithms are listed here and
in some cases we haven't listed all of them, there are available on the docks
page. You can wrap any algorithm that's out there and in scikit-learn, sci-py you
can you can wrap your own algorithm you seem to go into the Python libraries
that are are in this app and wrap them yourself tutorial for that will be will
be coming in the future. Brief moment about some of the dropdowns that I
skipped over before, in scheduled job's will actually be able to pull up all of
these scheduled training commands that you've set via your assistant
that was the green button again under say predict numeric fields this screen
button next to fit model allows me to schedule a fit if i choose to schedule
fit that it will then show up under scheduled jobs right here
central training. The alerts if i choose to set an alert through that
interactive assistant i'll actually be able to see those alerts here listed. So
you know that that's the machine learning toolkit here hmm so that's
machine learning toolkit thank you for your time.
In summary, the machine learning tool kit allows the user to customize machine
learning in their SPL search the showcases organized around those
modeling assistance so we have plenty of them here and a lot of pre populated
stories please take a look.
Thank you and happy mathematical modelling.