Investigate the dataset contents

Learn more about a dataset by sampling its contents, tracing data lineage, and viewing metadata through the Catalog in Splunk Cloud Platform.

Select a dataset to learn more about it.

When you select a dataset, the Catalog opens a side panel that contains details about the dataset as well as actions you can use to discover more information.

Sample the field values:
  1. Select Top 10 values per field to run an SPL2 search that returns the top 10 values from each event field in the dataset.
    Note: The Top 10 values per field action is not available for raw tables, which support limited search functionality.
  2. Set the time range picker beside the Search bar to an appropriate time range for the events in the selected dataset.
Run a limited search on a raw table:
  1. To validate the data that exists in a raw table and decide on next steps such as promoting the data or using a different dataset, select Search to search a raw table.
    CAUTION: Search raw tables sparingly. Searches on raw tables can be costly and return minimally processed events that have only the source, sourcetype, host, and _time fields extracted.
Trace Machine Data Lake promotion dependencies:
  1. For raw tables, analytics tables, and Splunk indexes created from promotions, view the Recent promotion jobs area of the side panel for information about how the data in one dataset originates from or depends on another dataset.

    The promotion information is determined by the dataset type:

    Dataset type Available promotion information
    Raw table

    The names of any analytics tables or Splunk indexes that use the raw table as a data source, and the status of the associated promotion job.

    Use this information to verify whether you need to promote data from the raw table or if a suitable promoted dataset is already available. Verify potential downstream impacts before deciding to edit or delete the raw table.
    Analytics table or Splunk index promoted from a raw table

    The name of the raw table that the data comes from and the status of the associated promotion job.

    Use this information to trace the source of the data that was promoted into the analytics table or Splunk index.
  2. For analytics tables and Splunk indexes created from promotions, view the Promotion mode field in the General area of the side panel to confirm whether the dataset is populated using a static or streaming promotion.
    Note: For more information about promotions, see Promote data in the Machine Data Lake manual.
Learn more about a dataset:
  1. Use the following actions to view more information about a selected dataset, depending on the dataset type:
    Dataset type Action
    Splunk index (non-promoted)

    Select View to go to the Indexes page and view details about the selected index.
    Federated dataset

    Select Edit to edit the dataset in the Data Management app and view configuration settings.
    Raw table

    Select View details to learn more about the selected dataset.

    Use the Overview tab to view general information about the dataset, and use the Manage and Edit data landing tabs to view configuration settings.
    Analytics table or Splunk index promoted from a raw table

    Select View details to learn more about the selected dataset.

    Use the Overview tab to view general information about the dataset, and use the Manage tab to view configuration settings.