Promote data to a Splunk index

Create a static or streaming Splunk index promotion from selected data in a Machine Data Lake raw table.

1. From the global navigation bar in Splunk Cloud Platform, select the Catalog () icon.
2. On the Catalog page, use the Datasets tab to find the raw table that contains the data you want to promote.

   You can search, filter by time range, sort table columns, or move through pages of datasets.

3. Select the raw table, and then select Promote.

   The promotion workflow opens for the selected dataset.

4. On the Configure step, select the Splunk index promotion type.

   Promotion type	When to use
   Static promotion to a Splunk index	Promote a fixed historical range when you need Splunk search, monitoring, alerting, dashboards, scheduled searches, or correlation for selected past data.
   Streaming promotion to a Splunk index	Promote matching new events when they must continue flowing into a promotion-managed Splunk index for monitoring, alerting, dashboards, or high-performance search.

5. Set the required time range or rolling time window for the selected Splunk index promotion type.

   For a static promotion, choose the historical time range that contains the data you need. Use a preset, relative range, date range, date and time range, or advanced earliest and latest values. Keep the range as focused as possible so the promotion includes only relevant data.

   For a streaming promotion, choose how long matching events stay available in the promoted dataset. Set a rolling time window that fits your search or alerting needs and does not exceed the maximum retention for the raw table.

6. (Optional) To filter the promotion to the events you need, select Add filter.

   Choose a field such as host, sourcetype, or source, and enter the value that identifies the events to include. For example, use host="web-server-01", sourcetype="access_combined", or source="/var/log/security.log" to promote a specific subset of data. Add more filters to narrow the data further, or use the delete icon to remove a filter that you no longer need.

7. Select Next.
8. On the Preview page, select the Run () icon or press Control+Enter to see the preview.

   Confirm that the preview contains the expected events, time range, source metadata, and field values before you start the promotion.

   Important: Don't use lookup-based processing in Machine Data Lake promotion workflows. Lookup actions and SPL2 processing that references lookups are not supported for static promotion to a Splunk index or streaming promotion to a Splunk index.
9. Configure optional processing for the Splunk index promotion.

   Use only the processing controls offered by the promotion workflow for the selected Splunk index promotion type.

   • In Partition, check the time range and filters. Edit entries that are too broad or too narrow, remove filters you no longer need, or add another partition control to narrow the promoted data. For more information, see Types of expressions.

   • In Actions, configure supported filtering, masking, or another supported transformation for the use case. You can filter values or mask values in _raw. Use a supported custom command function only when the selected promotion workflow offers it. Do not use lookup-based processing in Machine Data Lake promotion workflows. For more information, see Quick Reference for SPL2 commands.

   • To use a custom command function, see Custom command functions.

   • In Fields, follow the workflow for the selected Splunk index promotion type. Field selection is not required unless the workflow offers it for a specific transformation.

   Run preview again after each change to confirm that the promotion still includes the data you need.

10. If the preview does not show the data you expect, revise the time range, filters, or supported processing.

    A narrower time range or a more specific filter can reduce promotion volume. A broader time range or fewer filters can include data that the preview does not show.

11. When the preview matches the data you want to promote, select Next.
12. On the Review and finalize page, enter a unique promoted dataset name and optional description.

    Use a name and description that help you and your team understand what the promoted Splunk index contains, which raw table it came from, and whether the promotion is static or streaming.

13. Review the Promotion job summary and dataset summary sections.
14. Select Start promotion.
    Machine Data Lake creates a promotion job and opens the promotion job list in the Catalog Promotion jobs tab.