Key Machine Data Lake terms

Use these terms as the Machine Data Lake terminology source of truth while you prepare a source, land and validate data, discover and query datasets, promote selected data, and govern access after onboarding.

Land

Raw table

A raw table stores logs and events that land through a supported Machine Data Lake workflow. It becomes available in the Catalog automatically to users who have permission to discover it. Use the raw table as the retained source for raw search, promotion, supported Open Sharing, and retention controls.

Data landing

Data landing selects which incoming events are written to a raw table and how matching and nonmatching events are routed. In Create raw table or Edit data landing, define conditions using supported metadata such as source, sourcetype, and host.

Machine Data Lake-only routing

Machine Data Lake-only routing sends matching events to a raw table without continuing to an existing Splunk index. Use this routing model when current searches, dashboards, alerts, Enterprise Security content, or rollback plans do not require the index route.

Dual routing

Dual routing sends matching events to Machine Data Lake and also preserves an existing Splunk index path. Use dual routing when current searches, dashboards, alerts, Enterprise Security content, or rollback plans must continue using the existing index while matching events also land in Machine Data Lake, where supported.

Landing-time processing

Landing-time processing applies supported transformations before matching events are written to a raw table. Use only actions documented for the selected GA landing workflow. Preview and validate filtering, masking, and other supported transformations before saving because they change the retained data.

Discover and query

Catalog

The Catalog is the inventory and decision surface for Machine Data Lake datasets. Use the Catalog to inspect available metadata, start raw search or promotion, and open the management actions allowed for the dataset type and your access.

Raw search

Raw search uses SPL2 to query data directly in a raw table without first creating a promotion. Use a bounded time range and supported source metadata or raw-text criteria for landing validation and focused exploration.

Splunk search

Splunk search queries data in a Splunk index. Use Splunk search for operational search, dashboards, alerts, correlation, and Enterprise Security workflows that depend on existing or promoted Splunk indexes.

Analytics search

Analytics search queries a promoted analytics table. Use analytics search for structured analysis, reporting, notebooks, business intelligence, machine learning, or other supported analytics workflows.

Promotion

Promotion

Promotion sends selected data from a raw table to a supported destination. Promotion does not remove the source data from the raw table.

Static promotion

Static promotion creates a promotion target from a selected historical time range. Use static promotion when you need a fixed set of raw data in a Splunk index or analytics table.

Streaming promotion

Streaming promotion sends matching events that arrive after the promotion job becomes Active to a Splunk index. It does not backfill data that is already stored in the raw table; use a separate static promotion when you need historical data.

Promotion target

A promotion target is the dataset created by a promotion. Machine Data Lake supports Splunk index and analytics table targets. Static and streaming describe the promotion mode, not different target types.

Splunk index

A Splunk index is a promotion target for data that needs Splunk search, dashboards, alerts, correlation, or Enterprise Security workflows. Machine Data Lake can create static Splunk index promotions and streaming Splunk index promotions where supported.

Analytics table

An analytics table is a structured promotion target created from selected raw data. Query the resulting table through analytics search for reporting, notebooks, business intelligence, machine learning, or other supported structured-analysis workflows.

Promotion-time processing

Promotion-time processing configures the supported filters, masking, extraction, or transformations applied to a promotion target. For an analytics table promotion, define the output schema and use custom SPL2 when needed to extract fields or shape the schema.

Govern and operate

Dataset access

Dataset access determines which datasets a user can discover and which actions are available for each dataset type. Access is based on the user capabilities and the dataset-specific access configuration.

Retention

Retention controls how long data remains available in a raw table or destination. Configure raw table retention and destination retention according to the controls available for each dataset type.

Open Sharing

Open Sharing provides authorized, read-only access to a raw table or analytics table for supported external clients such as business intelligence tools, notebooks, and machine learning platforms. Open Sharing uses Delta Sharing profiles that can expire or be revoked. Splunk indexes do not use this access path.