Splunk Machine Learning

| mlspl fit <algo> field=<x>

Trains a machine learning model in Splunk (mlspl) on a field to detect statistical anomalies that rules don't see.

Use it when fixed-threshold detection doesn't work: the traffic of a host, the logons of a user, or the bytes of a connection vary over time, and a model trained on the baseline detects the deviation that a static threshold can't distinguish. The mlspl fit command trains the algorithm (densityfunction, kmeans, etc.) on the specified field, and the resulting model is applied in real time to score each event by its rarity. The typical case: event volume per host, cmdline length, or HTTP response size — what deviates from what was learned jumps out as an anomaly.

Don't use it without sufficient and clean historical data: the model learns from the baseline — noisy data (broken agents, maintenance windows) contaminates the model and the detected anomalies mean nothing. mlspl is expensive in training time and scoring on high volumes: models are retrained with appropriate frequency (daily, weekly) and real-time scoring has a per-event cost. And watch out for interpretation: a statistical anomaly is not an attack — it's a clue that requires context; the SOC that alerts on every deviation ends up with noise through the roof. For most detections, the threshold rule remains the right choice; ML is for cases where it doesn't work.