Search Machine Data Lake data from the Catalog

Search a raw table or promoted dataset through the search path that its dataset type supports.

You must have search or query permission for the selected raw table or promoted dataset.

The Catalog guide explains how to start a general search from the Catalog and continue working in the Search & Reporting app. See Search, transform, and analyze your data.

Use this task for Machine Data Lake-specific search choices. The supported search behavior depends on whether the dataset is a raw table, an analytics table, or a Splunk index promotion. Raw search helps validate that landed data exists, but raw tables are storage-optimized and might not provide the performance or field behavior expected for active investigations.

  1. From the global navigation bar in Splunk Cloud Platform, select the Catalog (Image of the "Catalog" icon) icon.
  2. On the Catalog page, in the Datasets tab, select the Machine Data Lake raw table or promoted dataset that you need to search.

    If you need help finding a dataset, see Find Machine Data Lake datasets in the Catalog.

  3. Select the available search action for the dataset type.

    The Catalog side panel can show Search, and the row action menu can show Open in search.

  4. For raw tables, constrain the search with supported fields such as source, sourcetype, host, and time.

    Use the results to identify the relevant time range and filters. Create a promotion for that selected data when the use case needs high-performance search, dashboards, alerting, or downstream analytics.

  5. For analytics tables, verify that Search Processing Language version 2 (SPL2) modules and data orchestration services are healthy if search results do not load.
  6. For Splunk index promotions, use the search syntax supported by the promotion type.

The dataset returns results through the supported search path for its type. For raw tables, the results can help confirm that relevant landed events exist before you promote a selected data slice.

If raw search confirms that the data is useful but you need faster search, dashboards, alerts, or analytics, see Choose an MDL data strategy, Promote data to a Splunk index, and Promote data to an analytics table.