# Version 7.0.2 # # This file contains possible attribute/value pairs for saved search entries in # savedsearches.conf. You can configure saved searches by creating your own # savedsearches.conf. # # There is the default savedsearches.conf in $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/default. To # set custom configurations, place a savedsearches.conf in # $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/local/. You must restart Splunk to enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles [default] args.mltk.experiment = [0|1] * default to 0 * If it sets to true, the saved search is a MLTK experiment type of saved search (schedule training or alert). args.mltk.experiment.alert.actualField = * the field produced by applying the algorithm used in the comparision * used in condition(s): num_predicted_value, r_squared_value, different_predicted_value args.mltk.experiment.alert.clusterId = * default to 0 * used in condition(s): cluster_id_count args.mltk.experiment.alert.comparator = * default to '>' * the operator to use * used in condition(s): num_outlier_count, num_predicted_value, cluster_id_count, cat_predicted_value args.mltk.experiment.alert.condition = * Required * the custom trigger condition for an experiment alert, can be expanded to have more values. * Possible values: 'numeric_outlier_count', 'categorical_predicted_value', 'cluster_id_count', 'categorical_outlier_count', 'numeric_predicted_value', 'smart_outlier_detection'. args.mltk.experiment.alert.count = * default to 0 * used in condition(s): num_outlier_count, cat_outlier_count args.mltk.experiment.alert.experimentType = * Required * The type of experiment where the alert is generated from * Possible values: * 'predict_numeric_fields', 'predict_categorical_fields', 'detect_numeric_outliers', 'detect_categorical_outliers', * 'forecast_time_series', 'cluster_numeric_events' args.mltk.experiment.alert.field = * the field produced by applying the algorithm used in the comparision * used in condition(s): num_predicted_value, cat_predicted_value, different_predicted_value args.mltk.experiment.alert.fields = * default to '[]' * a list of field names encoded in JSON * used in condition(s): cat_outlier_count, multi_numeric_predicted_values args.mltk.experiment.alert.firstCount = * default to 0 * used in condition(s): cluster_id_count args.mltk.experiment.alert.firstValue = * default to 0 * the value to compare to the selected field * used in condition(s): num_predicted_value args.mltk.experiment.alert.integerFields = * default to '[]' * the possible integer values which the cluster id can have * used in condition(s): 'cluster_id_range' args.mltk.experiment.alert.probableCauseFields = * default to '[]' * a list of field names encoded in JSON * used in condition(s): cat_outlier_count args.mltk.experiment.alert.secondCount = * default to 0 * used in condition(s): cluster_id_count args.mltk.experiment.alert.secondValue = * default to 0 * the value to compare to if the operator requires a second value * used in condition(s): num_predicted_value args.mltk.experiment.alert.selectedFields = * default to '[]' * a list of values encoded in JSON * used in condition(s): multi_numeric_predicted_values args.mltk.experiment.alert.selectProbableCause = [0|1] * default to 0 * used in condition(s): cat_outlier_count args.mltk.experiment.alert.type = * Deprecated, will replaced by experimentType * the type of alert generated by applying a model * possible values: * NumericValue, CategoricalOutlierCount, CategoricalValue, ClusterEventCount, NumericOutlierCount: args.mltk.experiment.alert.useMLTKCondition = [0|1] * default to true * whether an alert trigger condition uses MLTK specific ones * If true, this saved search is using a custom trigger condition specific to MLTK Experiments args.mltk.experiment.alert.values = * default to '[]' * a list of values encoded in JSON * used in condition(s): cat_predicted_value args.mltk.experiment.title = * A human readable title of experiment type of saved search, since the original 'name' field is set to uuid. display.visualizations.custom.Splunk_ML_Toolkit.DistributionViz.showOutliers = [0|1] * default to 1 * Whether or not to show outliers display.visualizations.custom.Splunk_ML_Toolkit.DistributionViz.showHistogram = [0|1] * default to 1 * Whether or not to show the histogram display.visualizations.custom.Splunk_ML_Toolkit.DistributionViz.showOutlierArea = [0|1] * default to 1 * Whether or not to show the utlier area display.visualizations.custom.Splunk_ML_Toolkit.DistributionViz.distributionCount = * default to 5 * The number of distributions to show on the visualization display.visualizations.custom.Splunk_ML_Toolkit.ForecastViz.showConfInterval = [0|1] * default to 1 * Whether or not to show the confidence interval display.visualizations.custom.Splunk_ML_Toolkit.ForecastViz.legendAlign = ['bottom'|'right'|'left'|'top'] * default to 'bottom' * Control the legend position display.visualizations.custom.Splunk_ML_Toolkit.HeatmapViz.highlightDiagonals = [0|1] * default to 1 * Whether or not to highlight diagonals display.visualizations.custom.Splunk_ML_Toolkit.HistogramViz.stacking = [0|1] * default to 1 * Whether or not to show the stacking display.visualizations.custom.Splunk_ML_Toolkit.HistogramViz.stackingMode = ['normal'|'overlap'] * default to 'normal' * Show the mode of the stacking display.visualizations.custom.Splunk_ML_Toolkit.HistogramViz.showLegend = [0|1] * default to 0 * Whether or not to show the legend display.visualizations.custom.Splunk_ML_Toolkit.LinesViz.showNavigator = [0|1] * default to 0 * Whether or not to show the navigator display.visualizations.custom.Splunk_ML_Toolkit.LinesViz.sortXAxis = [0|1] * default to 0 * Whether or not to sort the X Axis display.visualizations.custom.Splunk_ML_Toolkit.OutliersViz.showConfidenceInterval = [0|1] * default to 1 * Whether or not to show the confidence interval display.visualizations.custom.Splunk_ML_Toolkit.OutliersViz.showOutlierCount = [0|1] * default to 1 * Whether or not to show the outlier count display.visualizations.custom.Splunk_ML_Toolkit.OutliersViz.showOutlierPoints = [0|1] * default to 1 * Whether or not to show outlier points display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.bgColor = ['auto'|'black'|'white'] * default to 'auto' * Control the background color display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.showLegend = [0|1] * default to 1 * Whether or not to show the legend display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.legendOrder = ['numeric'|'default'] * default to 'numeric' * Control the legendOrder display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.aspectMode = ['auto'|'cube'|'data'|'manual'] * default to 'auto' * Control the aspect mode display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.xAspectRatio = * Control the X Aspect Ratio display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.yAspectRatio = * Control the Y Aspect Ratio display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.zAspectRatio = * Control the Z Aspect Ratio display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.size = * default to 8 * Control the size of the marker display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.opacity = * default to 0.5 * Control the opacity of the marker display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.symbol = ['circle'|'circle-open'|'square'|'square-open'|'diamond'|'diamond-open'|'cross'|'x'] * default to 'circle' * Control the symbol shape display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.lineWidth = * default to 0 * Control the line width display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.xTitle = * Control the X-Axis Label display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.xAxisField = * default to x * Control the X-Axis Field display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.yTitle = * Control the Y-Axis Label display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.yAxisField = * default to y * Control the Y-Axis Field display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.zTitle = * Control the Z-Axis Label display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.zAxisField = * default to z * Control the Z-Axis Field display.visualizations.custom.Splunk_ML_Toolkit.Scatter3dViz.catLimit = * default to 50 * Control the limit on the number of categorical fields display.visualizations.custom.Splunk_ML_Toolkit.ScatterLineViz.identityLine = [0|1] * default to 0 * Whether or not to show the identity line (x=y) display.visualizations.custom.Splunk_ML_Toolkit.ScatterLineViz.showLegend = [0|1] * default to 1 * Whether or not to show the legend display.visualizations.custom.Splunk_ML_Toolkit.ScatterLineViz.legendOrder = ['numeric'|'default'] * default to 'numeric' * Control the legend order display.visualizations.custom.Splunk_ML_Toolkit.ScatterLineViz.showAxisLabels = [0|1] * default to 1 * Whether or not to show axis labels display.visualizations.custom.Splunk_ML_Toolkit.ScatterLineViz.legendAlign = ['bottom'|'right'|'left'|'top'] * default to 'bottom' * Control the legend position