Preserve a Splunk index path when using a data landing definition

Create an Ingest Processor pipeline that sends matching events to a Splunk index while a raw table landing definition routes the same matching events to Machine Data Lake.

  • Events already reach Splunk Cloud Platform through a supported HEC, Universal Forwarder, or Heavy Forwarder path.

  • You have a Machine Data Lake raw table and permission to edit its data landing definition.

  • You have permission to create, save, and activate Ingest Processor pipelines.

  • You know the Splunk index that must continue receiving matching events.

Use this procedure when a raw table landing definition selects matching events from an existing index route. Selecting a partition such as sourcetype="cisco:asa" redirects matching events from the existing index route to the raw table. To continue the Splunk index route, create and activate an Ingest Processor pipeline with the same condition and a Splunk index destination for the preserved index. Use Ingest Processor for this procedure, not Edge Processor.

  1. Open the raw table and edit the data landing definition.

    Use Edit data landing to select the matching events that must land in Machine Data Lake.

  2. Add or confirm the landing partition for the matching events.

    For example, add a partition that matches sourcetype="cisco:asa". Add source or host conditions if the raw table must receive a narrower subset.

  3. Preview the landing definition with representative matching and non-matching events.

    Confirm that matching events are selected for the raw table and representative non-matching events are not selected.

  4. Save the data landing definition.

    After the landing definition is active, matching events land in the Machine Data Lake raw table.

  5. Create an Ingest Processor pipeline for the preserved Splunk index path.

    Create an Ingest Processor pipeline, not an Edge Processor pipeline. Use the same matching condition that you used in the raw table landing definition, such as sourcetype="cisco:asa".

  6. Set the Ingest Processor pipeline destination to the preserved Splunk index.

    Select a Splunk index destination and choose the index that must continue receiving matching events. Keep the condition aligned with the raw table landing definition so both routes handle the same matching events.

  7. Save and activate the Ingest Processor pipeline.
  8. Send a uniquely identifiable test event through the existing input path.

    Use a value that is not already present in production data, such as mdl_test_id=<unique_id>, and make sure the event matches the partition condition.

  9. Validate the test event in the raw table and the preserved Splunk index.
    CODE 
    mdl_test_id="<unique_id>" sourcetype="cisco:asa"
    CODE 
    index=<preserved_index> mdl_test_id="<unique_id>" sourcetype="cisco:asa" earliest=-30m latest=now
  10. Verify that non-matching events still follow the intended route.

    Send or identify a representative event that does not match the landing partition. Confirm that it does not land in the raw table and that it follows the expected default or preserved destination.

Matching events land in the Machine Data Lake raw table and continue to the preserved Splunk index through the Ingest Processor pipeline. Non-matching events do not land in the raw table and continue to follow the intended route.

For more information, see Create pipelines for Ingest Processor and How data moves through the Ingest Processor solution.