Deep Dives

Share data in the AI Toolkit

When the AI Toolkit is deployed on Splunk Enterprise, the Splunk platform sends aggregated usage data to Splunk Inc. (\"Splunk\") to help improve the AI Toolkit in future releases. For information about how to opt in or out, and how the da…

When the AI Toolkit is deployed on Splunk Enterprise, the Splunk platform sends aggregated usage data to Splunk Inc. ("Splunk") to help improve the AI Toolkit in future releases. For information about how to opt in or out, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

What data is collected

The AI Toolkit collects the following basic usage information:

Component Description Example
ai_processing_time Time taken to process the ai command request. Triggered during ai command usage. JSONCopy
json<br>{<br>"command": "ai",<br>"ai_processing_time":0.7969220000000001<br>}<br>
algo_name Name of algorithm used in fit or apply. JSONCopy
json<br>{<br> "algo_name": "StandardScaler"<br>}<br>
app_context Name of the app from which search is run. JSONCopy
json<br>{<br> "app_context": "Splunk_ML_Toolkit"<br>}<br>
apply_time Time the apply command took. JSONCopy
json<br>{<br> 'apply_time': 0.005<br>}<br>
app.session.Splunk_ML_Toolkit.changeSmartAssistantStep User progress through an AI Toolkit Smart Assistant. JSONCopy
json<br>{<br>   component: app.session.Splunk_ML_Toolkit.changeSmartAssistantStep<br> data: { [-]<br> app: Splunk_ML_Toolkit<br> experiment_id: 63fb7afba756455d8056b5e547f8545f<br> experimentType: smart_outlier_detection<br> page: smart_outlier_detection<br> previousStep: learn<br> step: define<br> }<br> deploymentID: 88A80D96D80B30B6F48E3FF9A0B318<br> eventID: 7185ae51-04aa-2025-8a57-6e0340e50c46<br> experienceID: d914fba4-7ca1-4370-a123-3a03a01d2569<br> optInRequired: 3<br> timestamp: 1585251931<br> userID: 60749ba2789ec1eee0ada6a0b5680512460559541023017ad6f5b4a3b0172841<br> version: 4<br> visibility: anonymous,support<br>}<br>
app.session.Splunk_ML_Toolkit.createExperiment User creating an AI Toolkit Experiment. JSONCopy
json<br>{<br>   component: app.session.Splunk_ML_Toolkit.createExperiment<br>   data: {<br>     app: Splunk_ML_Toolkit<br>     experiment_id: 09ca5db894894c86b20b083941acaae0<br>     experimentType: smart_forecast<br>     page: experiments<br>   }<br>   deploymentID: 88A80D96D80B30B6F48E3FF9A0B318<br>   eventID: 8318866b-f2f5-35a4-1348-b82486b3a41f<br>   experienceID: dfbde5b8-eb57-10a3-5ced-3be47f2b8ad2<br>   optInRequired: 3<br>   timestamp: 1583786919<br>   userID: 60749ba2789ec1eee0ada6a0b5680512460559541023017ad6f5b4a3b0172841<br>   version: 4<br>   visibility: anonymous,support<br>}<br>
app.session.Splunk_ML_Toolkit.createExperimentAlert Users creating alerts for AI Toolkit Experiments. JSONCopy
json<br>{<br>      component: app.session.Splunk_ML_Toolkit.createExperimentAlert<br>   data: {<br>     app: Splunk_ML_Toolkit<br>     experiment_id: 46221dd8661d420aaa988ca7d41821ae<br>     experimentType: smart_forecast<br>     page: experiments<br>   }<br>   deploymentID: 88A80D96D80B30B6F48E3FF9A0B318<br>   eventID: 6bd85948-4f9b-ff9d-bf02-18defe062eec<br>   experienceID: f2c4f65b-a723-88af-875a-73737bbc9061<br>   optInRequired: 3<br>   timestamp: 1584480173<br>   userID: 60749ba2789ec1eee0ada6a0b5680512460559541023017ad6f5b4a3b0172841<br>   version: 3<br>   visibility: anonymous,support<br>}<br>
app.session.Splunk_ML_Toolkit.loadAssistant Number of times the user has loaded an AI Toolkit Assistant. JSONCopy
json<br>{<br>   component: app.session.Splunk_ML_Toolkit.loadAssistant<br> data: { [-]<br> app: Splunk_ML_Toolkit<br> experiment_id: 6196da5dc78f4606925295ead869f023<br> experimentType: smart_clustering<br> page: smart_clustering<br> }<br> deploymentID: 88A80D96D80B30B6F48E3FF9A0B318<br> eventID: 54e3887b-acf3-ba6c-7f4f-cef1373c4d99<br> experienceID: d914fba4-7ca1-4370-a123-3a03a01d2569<br> optInRequired: 3<br> timestamp: 1585270611<br> userID: 60749ba2789ec1eee0ada6a0b5680512460559541023017ad6f5b4a3b0172841<br> version: 4<br> visibility: anonymous,support<br>}<br>
app.session.Splunk_ML_Toolkit.saveExperiment Users saving their work in AI Toolkit Experiments. JSONCopy
json<br>{<br>  component: app.session.Splunk_ML_Toolkit.saveExperiment<br>   data: {<br>     app: Splunk_ML_Toolkit<br>     experiment_id: 4f390e49096c43adb05feb29fe9bfbbc<br>     experimentType: smart_outlier_detection<br>     page: smart_outlier_detection<br>}<br>deploymentID: 88A80D96D80B30B6F48E3FF9A0B318<br>   eventID: bdc34718-163c-56c0-3c7b-7d51380a258e<br>   experienceID: dfbde5b8-eb57-10a3-5ced-3be47f2b8ad2<br>   optInRequired: 3<br>   timestamp: 1583873964<br>   userID: 60749ba2789ec1eee0ada6a0b5680512460559541023017ad6f5b4a3b0172841<br>   version: 4<br>   visibility: anonymous,support<br>}<br>
app.session.Splunk_ML_Toolkit.scheduleExperimentTraining Users scheduling model re-training for AI Toolkit Experiments. JSONCopy
json<br>{<br>   component: app.session.Splunk_ML_Toolkit.scheduleExperimentTraining<br>   data: {<br>     app: Splunk_ML_Toolkit<br>     experiment_id: 46221dd8661d420aaa988ca7d41821ae<br>     experimentType: smart_forecast<br>     page: experiments<br>     scheduleEnabled: true<br>   }<br>   deploymentID: 88A80D96D80B30B6F48E3FF9A0B318<br>   eventID: 629db0e3-0db1-0424-5e0d-f7e06e9965fb<br>   experienceID: f2c4f65b-a723-88af-875a-73737bbc9061<br>   optInRequired: 3<br>   timestamp: 1584480148<br>   userID: 60749ba2789ec1eee0ada6a0b5680512460559541023017ad6f5b4a3b0172841<br>   version: 3<br>   visibility: anonymous,support<br>}<br>
col_dimension Collects dimension of the dataset from model schema. Triggered during apply. JSONCopy
json<br>{ <br>"col_dimension" : "Multiple columns single-dim input",<br>"command" : "onnx_input_shape<br>}<br>
columns The number of columns being run through fit command. JSONCopy
json<br>{<br> "columns": 10<br>}<br>
command fit, apply, or score JSONCopy
json<br>{<br> "command":"fit"<br>}<br>
JSONCopy
json<br>{<br> "command":"apply"<br>}<br>
JSONCopy
json<br>{<br> "command":"score"<br>}<br>
csv_parse_time CSV parse time. JSONCopy
json<br>{<br> "csv_parse_time": 0.019296<br>}<br>
csv_read_time CSV read time. JSONCopy
json<br>{<br> "csv_read_time": 0.019296<br>}<br>
csv_render_time CSV render time. JSONCopy
json<br>{<br> "csv_render_time" : 0.01162<br>}<br>
deployment.app Apps installed per Splunk instance. JSONCopy
json<br>component: deployment.app <br>   data: { <br>     enabled: true <br>     host: monitoring <br>     name: alert_webhook <br>     version: 7.0.1 <br>   } <br>   date: 2018-10-26 <br>   deploymentID: 99b6ffd8-2e80-5e3b-905c-8c6f6fd743a0 <br>   executionID: F0AE995E8653D768A360E73BE3F544 <br>   timestamp: 1540570045 <br>   transactionID: 89F7329E-86AD-BBFD-034F-209CB8A06F05 <br>   version: 3 <br> visibility: anonymous, support<br>
df_shape Shape of data input received from splunk. Triggered during apply. JSONCopy
json<br>{ <br>"command" : "onnx_input_shape", <br>"dataframe_shape" : "(768, 8)"<br>}<br>
example_name Name of the Showcase example being run. JSONCopy
json<br>{<br> 'example_name': "'Predict Server Power Consumption'"<br>}<br>
experiment_id ID of the fit and apply run on the Experiments page. All preprocessing steps and final fit have the same ID. JSONCopy
json<br>{<br> "experiment_id": "6c47bca2776d4b6cb82685461d918180"<br>}<br>
fit_time Amount of time it took to run the fit command. JSONCopy
json<br>{<br> "fit_time": 39.87447<br>}<br>
full_punct The punct of the data during fit or apply. JSONCopy
json<br>{<br> "full_punct": [<br>...s-s-s[//:::.s-]s"s/-/////.s/."sss"://:/-//@:///-."s"/.s(;sssss)s/.s(,ss)s/...s/."s-ss<br>]<br>}<br>
handle_time Time for the handler to handle the data. JSONCopy
json<br>{<br> "handle_time": 0.274072<br>}<br>
metrics_type Collects the type of request sent. Used to differentiate model upload and model inference call flows.

Contains two values:
- onnx_upload
- onnx_infer		 JSONCopy
json<br>{ <br>"command" : "metrics_type",<br>"metrics_type" : "onnx_upload"<br>}<br>
model To capture the LLM model name under the specific provider while running the ai command. JSONCopy
json<br>{<br>"command": "ai",<br>"model":"gpt-4o"<br>}<br>
modelId Model ID in which user saves their model. JSONCopy
json<br>{<br>modelId: 56ce5ff2442604580eca0f57f36b5b9c<br>}<br>
model_upload Monitors the model upload process to determine if the model has been successfully uploaded and is ready for inference. JSONCopy
json<br>{<br>"command": "upload",<br>"metrics_type": "onnx_upload"<br>"model_upload": "1"<br>}<br>
numColumns Total number of columns in the dataset. JSONCopy
json<br>{<br> numColumns: 16 <br>}<br>
numRows Total number of rows (events) in the dataset. JSONCopy
json<br>{<br> numRows: 150<br>}<br>
num_fields Total number of fields. JSONCopy
json<br>{<br> "num_fields": 4<br>}<br>
num_fields_fs Number of fields that have the fs for Field Selector prefix. JSONCopy
json<br>{<br> "num_fields_fs": 9<br>}<br>
num_fields_PC Number of fields that have the PC for preprocessed prefix. JSONCopy
json<br>{<br> "num_fields_PC": 70<br>}<br>
num_fields_prefixed Total number of preprocessed fields. JSONCopy
json<br>{<br> "num_fields_prefixed": 28<br>}<br>
num_fields_RS Number of fields that have the RS for Robust Scaler prefix. JSONCopy
json<br>{<br> "num_fields_RS": 17<br>}<br>
num_fields_SS Number of fields that have the SS for Standard Scaler prefix. JSONCopy
json<br>{<br> "num_fields_SS": 30<br>}<br>
num_fields_tfidf Number of fields that have used term frequency-inverse document frequency preprocessing. JSONCopy
json<br>{<br> "num_fields_tfidf": 9<br>}<br>
onnx_input_shape Shape of input data stored in the onnx model schema. Triggered during apply time. JSONCopy
json<br>{ <br> "command" : "onnx_input_shape",<br> "onnx_input_shape" : "['unk__16', 8]"<br>}<br>
onnx_model_size_on_disk Total size in MB taken up by the model file on the disk after encoding. Triggered during model upload. JSONCopy
json<br>{<br>"command": "onnx_model_size_on_disk_mb",<br>"onnx_model_size_on_disk_mb": 0.001977<br>}<br>
onnx_upload_time Time taken to upload an onnx model file from UI. Triggered during model upload. JSONCopy
json<br>{<br>"command": "onnx_model_validate_and_upload",<br>"onnx_upload_time":0.8969220000000001<br>}<br>
orig_sourcetype The original sourcetype of the machine data. JSONCopy
json<br>{<br> "orig_sourcetype" : "access_combined_wcookie"<br>}<br>
params Optional parameters used in fit step. JSONCopy
json<br>{<br> "params": "{{\"with_std\": \"true\", \"with_mean\": \"true\"}}"<br>}<br>
params Collects the boolean value of supervise_split_by. Checks whether DecisionTreeRegressor is used as part of DensityFunction. JSONCopy
json<br>{<br>"command": " "supervise_split_by": "true" "<br>}<br>
partialFit Whether or not the fit is a type of partial fit action. JSONCopy
json<br>{<br>partialFit: True<br>}<br>
PID Process identifier associated with the command. JSONCopy
json<br>{<br> "PID" : 63654<br>}<br>
pipeline_stage Each preprocessing step on the Experiments page is assigned a number starting from 0. This helps determine the order of the preprocessing steps and length of the pipeline. JSONCopy
json<br>{<br> "pipeline_stage": 0<br>}<br>
provider To capture the provider name while running the ai command. JSONCopy
json<br>{<br>"command": "ai",<br>"provider": "Openai"<br>}<br>
rows The number of rows being run through fit command. JSONCopy
json<br>{<br> 'rows': 15627<br>}<br>
rows The number of rows processed at a given ai command request. JSONCopy
json<br>{<br>"command": "ai",<br>"rows":100<br>}<br>
rows_processor_time Time taken to process the rows in seconds while using the ai command request. JSONCopy
json<br>{<br>"command": "ai",<br>"rows_processor_time":0.7969220000000001<br>}<br>
SageMaker model apply/inference event The AWS Sagemaker model apply/inference event. JSONCopy
json<br>{<br>"command": "apply",<br>"runtime": "sagemaker",<br>"model": "sg_anomaly_model_detector",<br>"algo_name": "sagemaker_custom_model",<br>"total_processed_time": 3.5656,<br>}<br>
scoringName Name of the scoring operation if whitelisted. If name is not whitelisted, logs the hash of the scoringName. CODECopy
makefile<br>scoringName: mean_squared_error<br>
scoringTimeSec Time taken by the scoring operation. CODECopy
makefile<br>scoringTimeSec: 3.398707<br>
UUID Universally unique identifier associated with command. This is 128-bit and used to keep each fit/apply unique. JSONCopy
json<br>{<br> "UUID": "7e0828e7-3059-4a43-8419-acc0e81f2f2d"<br>}<br>

Source: /en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/additional-resources/share-data-in-the-ai-toolkit (upstream Splunk AITK 5.6.4 docs)

Press Cmd/Ctrl+K to focus search. Esc to close.

Type to search the portal.