When to use batch learning, online learning (with Splunk) and offline learning (with the notebook)?

Hi I am new with Splunk. But in the past I have worked with jupyter notebook doing machine learning. Specifically with static databases (.csv) I know splunk is to convert Unstructured data to a structured one. Also, it can do batch learning and online learning. But I have seen that sometimes the data is analyzed offline using the jupyter notebook. And I am wondering why? 1. Why the training is done in the Notebook when Splunk allows you to upload, modify algorithms and has batch learning and online learning? These are the video and pdf file where the data is downloaded to the notebook: (29:22) https://www.youtube.com/watch?v=e6ZL29t-qbY (slide 24) https://conf.splunk.com/files/2016/slides/demystifying-machine-learning-and-anomaly-detection-practical-applications-in-splunk-for-insider-threat-detection-and-security-analytics.pdf Thank you