Search, transform, and analyze your data

Run targeted searches on relevant datasets through the Catalog in Splunk Cloud Platform.

After finding the relevant dataset for your investigation, you can run a targeted search on that dataset and start working with the data that you need.

By using the Catalog to find the right dataset, you can avoid running slow and expensive searches that span multiple datasets, such as index=*.

Raw tables can be costly to search and support limited search functionality. To work with data from a raw table, start by identifying the relevant subset of events and promoting them into an analytics table or Splunk index. Then, run your searches on the analytics table or Splunk index instead of the raw table. For more information, see the following pages in the Machine Data Lake manual:

Run a search with the default time range:
  1. Select the dataset on the Catalog, and then select Search from the side panel.

    When you select Search, you run an SPL2 search in the Search & Reporting app that retrieves all the events in the dataset that match the default time range, typically in the last 30 minutes.

    For information about how to continue building and refining your search, refer the following documentation:

    For this information Refer to this documentation
    Using SPL2 to work with your data
    Searching federated datasets
Write a search using SPL or without running the search immediately:
  1. To navigate to the Search & Reporting app, select Home to return to the Splunk home page.
  2. From the Apps panel, select Search & Reporting.
  3. Set the language picker to SPL or SPL2.
    When searching a Splunk index, you can use either SPL or SPL2. For federated datasets, raw tables, and analytics tables, you must use SPL2.
  4. In the Search bar, enter a search that targets the dataset you discovered through the Catalog.
    For example, the following SPL search targets a Splunk index named my_logs:
    CODE 
    index=my_logs
    As another example, the following SPL2 search targets a federated dataset named my_logs:
    CODE 
    FROM my_logs

    For information about using SPL searches, see the following documentation:

For information about how to create knowledge objects based on your search results, refer to the following documentation:

Task Documentation
Visualizing your search results in a dashboard See the Dashboard Studio manual.
Saving your search as a report that you can use again at a later time or run on a scheduled interval See the Reporting Manual.
Setting up alerts that notify you when the search results meet specific conditions See the Alerting Manual.