Create a static or streaming analytics table promotion from selected data in a Machine Data Lake raw table.
-
You have static promotion permission for static promotions or streaming promotion permission for streaming promotions on the selected raw table.
-
You have view or query access to the raw table so that you can review dataset details and run promotion preview before you submit the promotion.
-
You know the fields, field names, and field types that the analytics workflow requires. Define the exact output schema before you start the promotion.
-
You have sample events that contain the fields you need to extract from the raw data.
Promote data to an analytics table when you need selected fields for analytics search, reporting, notebooks, business intelligence, machine learning, or large-scale analysis. Use a static promotion for a fixed historical time range. Use a streaming promotion to keep the analytics table updated as matching events arrive.
Note: A streaming promotion includes matching events that arrive after the job starts. To promote events already stored in the raw table, create a separate static promotion.
An analytics table promotion requires field extraction and schema definition. Select Extract fields from raw, review the extracted fields, define the exact output schema, and use custom SPL2 when needed to extract fields or shape the schema. Promotion does not remove the source data from the raw table, which keeps its own retention settings.
- From the global navigation bar in Splunk Cloud Platform, select the Catalog (
) icon.
On the Catalog page, the Datasets tab is selected by default.
- In the Datasets tab, find the raw table that contains the data you want to promote.
You can search, filter by time range, sort table columns, or move through pages of datasets.
- Select the raw table and then select Promote.
The promotion workflow opens for the selected dataset.
- On the Configure step, select the analytics table promotion type.
- Set the time range or rolling window for the selected promotion type.
For a static promotion, select the historical time range that contains the data you need. Keep the range focused on the events required for your analysis.
For a streaming promotion, set the rolling window to specify how long data remains available in the analytics table.
- (Optional) To narrow the promotion to specific events, select Add filter.
Choose a field such as host, sourcetype, or source, and enter the value that identifies the events to include. Add more filters to narrow the data further, or remove a filter that you no longer need.
- Select Next.
- On the Preview page, select Extract fields from raw.
Field extraction creates candidate fields from representative raw events in the selected time range. If the extraction does not find a required field, use custom SPL2 when needed to extract the field or shape the schema.
- Review the extracted fields.
Keep only the fields that the analytics table must contain. Remove fields that are not needed for the analytics workflow, and confirm that the retained fields use clear names and expected values.
- Define the exact output schema for the analytics table.
Confirm each field name, field type, and output shape before you create the table. The schema determines the fields and types available when you query the analytics table.
- When required fields are missing or the output schema needs additional shaping, turn on SPL2 editor and add custom SPL2.
Use custom SPL2 to extract fields from _raw, rename fields, cast values, or shape the table schema when the field extraction output is not sufficient.
- Select the Run (
) icon or press Control+Enter to preview the analytics table output.
Validate that the preview includes the expected rows, excludes unwanted events, and shows the exact fields and types that the analytics workflow requires.
- Revise the time range, filters, extracted fields, schema, or custom SPL2 until the preview matches the analytics table you intend to create.
Run preview again after each change. Do not continue until the preview output matches the required schema and representative rows.
- When the preview matches the analytics table you want to promote, select Next.
- On the Review and finalize page, enter a unique promoted dataset name and optional description.
Use a name and description that help you and your team understand what the analytics table contains, which raw table it came from, and which schema it uses.
- Review the Promotion job summary and Dataset summary sections.
- Select Start promotion.
Machine Data Lake creates a promotion job and opens the promotion job list in the Catalog Promotion jobs tab.
Machine Data Lake creates an analytics table using the selected filters, fields, and field types. A static promotion includes data from the selected historical time range. A streaming promotion continues to add matching events while the job is active. The source data remains in the raw table.
Note: You can find the promoted dataset in the Catalog only on the search head where you created the promotion.
In Catalog, select the Promotion jobs tab and refresh the job list. Open the job details and follow the promoted dataset link when the static promotion completes or the streaming promotion becomes active. See Monitor and manage promotion jobs.
To search the analytics table, see Search Machine Data Lake data from the Catalog.