Search commands for machine learning safeguards

The Splunk platform contains search processing language (SPL) safeguards to warn you when you might unknowingly run a search in Splunk Web that has commands that can modify the model, and might be either a security or a performance risk. If a search command that Splunk classifies as risky triggers the safeguard, a warning dialog box appears to provide extra context for review, as well as the option to accept the risk and run the query anyway.

The fit, deletemodel, ai , and aiagent commands are considered as risky. When using the fit, deletemodel, ai, and aiagent commands, you might see security warning messages.

Example 1

This image shows an example of a warning message that can appear on screen when calling the fit command. The message prompts the user to Cancel, Run, or Investigate the search string.

Example 2

This image shows an example of a warning message that can appear on screen when calling the aiagent command. The message prompts the user to Cancel, Run Query Anyway, or Investigate the search string.

The following are scenarios under which this warning can appear:

  • When the fit, deletemodel, or ai command is run for the first time after logging into the system with a URL.
  • When you refresh the page or log back in with the URL.
  • When you use the Open in Search option in the AI Toolkit.

  • When you use the Open in Search option to invoke an agent in the AI Toolkit which uses the aiagent command.

  • When viewing certain Showcase examples.

The fit, deletemodel, ai, and aiagent commands are not core Splunk search commands, and are only provided when the AI Toolkit is installed. You can follow the same steps for core search commands if you want to prevent the safeguard warning messages. See, Deactivate SPL safeguards in the Splunk Enterprise manual.