Promote data

Choose a promotion target and mode when landed data needs a Splunk index or analytics table. Use raw search and Open Sharing as separate consumption paths.

Promotion creates a query target for a specific operational-search or structured-analytics workflow. Do not promote broad raw data by default. Choose the promotion target before you configure processing. Use a Splunk index promotion for operational Splunk search, dashboards, alerts, scheduled searches, monitoring, or correlation. The workflow also provides optional filtering, masking, and other supported transformations. A static promotion to an analytics table requires an explicit schema: select Extract fields from raw, review the extracted fields, define the exact fields to promote, and use custom SPL2 when needed to extract fields or shape the schema. Promotion-time processing changes only the promotion target and does not change the source raw data. Preview after each change.

Compare ways to use landed data

Path	Use it when	What happens to the data	Before you continue
Raw search	You need targeted validation, event inspection, or a narrow investigation before deciding whether to promote.	No additional dataset is created. The search reads data from the raw table within its retention period.	Use a narrow time range and confirm that raw search performance and field behavior are sufficient for the task.
Static promotion to a Splunk index	Use a static promotion to a Splunk index when a bounded historical slice must support repeated Splunk search, dashboards, alerts, scheduled searches, or correlation.	Static promotion sends data from the selected historical time range and filters to a Splunk index. The source data remains in the raw table according to the raw table retention policy.	Confirm static promotion access, service-account readiness, time range, filters, target name, retention, and any optional processing that you intend to apply.
Streaming promotion to a Splunk index	Use a streaming promotion to a Splunk index when matching new events must continue arriving in a promotion-managed Splunk index for monitoring, alerting, dashboards, or high-performance search.	Streaming promotion processes matching events that arrive after the promotion job becomes Active. It does not automatically promote data already stored in the raw table. Create a separate static promotion when you need historical data.	Confirm streaming promotion access, Ingest Processor capacity, filters, rolling window, and rollback expectations.
Static promotion to an analytics table	Use a static promotion to an analytics table when a bounded historical slice needs an explicit structured schema for wide scans, reporting, compliance review, notebooks, business intelligence, or machine learning workflows.	Static promotion creates an analytics table for the selected historical range and the exact schema that you define during promotion.	On the preview step, select Extract fields from raw, review the extracted fields, and define the exact schema to promote. Use custom SPL2 when needed to extract fields or shape the schema, then preview the final output before you start the promotion.
Open Sharing	A supported external consumer needs authorized read-only access to selected data without a manual export.	Where supported, sharing grants access to a dataset through a sharing profile or token and an expiration or revocation control.	Confirm Open Sharing support, sharing capability, expiration, revocation, audit expectations, and downstream consumer ownership.
Federated access	Data must stay in another supported system and you need an in-place query path rather than Machine Data Lake landing or promotion.	The data remains in the external system and is queried through the supported federated path.	Confirm source access, query behavior, latency, metadata limits, and retention in the external system.

When to create a promotion

Create a promotion when a raw table contains events that need indexed search, dashboards or alerts, repeated high-performance search, or a structured analytics schema. Choose a Splunk index or analytics table based on the use case.

Keep data in the raw table when you only need to retain it, inspect it, or run limited validation searches.

Before you promote, use Choose an MDL data strategy to confirm that promotion is the right next step.

To create and track a promotion, see Promote data to a Splunk index, Promote data to an analytics table, and Monitor and manage promotion jobs.