Create and manage datasets

Use the Datasets tab of the Catalog to create, edit, and delete datasets that make data from various sources available for search, analysis, and processing in Splunk Cloud Platform.

1. Use the following actions to create a dataset, depending on the dataset type:

   Dataset type	Action
   Splunk index (non-promoted)	Non-promoted Splunk indexes are managed through the Indexes page instead of the Catalog. For instructions, see Manage Splunk Cloud Platform indexes.
   Federated dataset	On the Catalog, select Create and then Dataset. Follow the on-screen guidance to create a dataset that accesses data from your data store of interest. For detailed instructions about configuring a federated dataset, refer to the following documentation: For information about creating datasets to retrieve data from data stores through federated searches, see the Federated Search manual. For information about creating datasets to process and write data to data stores through Edge Processor pipelines, see the Use Edge Processors for Splunk Cloud Platform manual. For information about creating datasets to process and write data to data stores through Ingest Processor pipelines, see the Use Ingest Processors manual.
   Raw table	On the Catalog, select Create and then Dataset. On the Select data store screen, select Machine Data Lake (MDL) and then select Next. Follow the on-screen guidance to create a raw table. For more information, see Create a Machine Data Lake raw table in the Land Data in machine Data Lake manual.
   Analytics table or Splunk index promoted from a raw table	Analytics tables and promoted Splunk indexes are created through data promotions. For more information, see Promote data in the Land Data in Machine Data Lake manual.

2. On the Datasets tab of the Catalog, select a dataset and then use the following actions to edit the dataset configuration, depending on the dataset type:

   Dataset type	Action
   Splunk index (non-promoted)	Select View to go to the Indexes page. Then, select the Actions () icon and select Edit. You can specify configurations such as the maximum capacity of the index and how the index retains data in searchable or long-term storage.
   Federated dataset	Select the Actions () icon and then select Manage. You can specify configurations such as which data catalog to use for managing the dataset and which partitions to use as time partitions.
   Raw table	Select the Actions () icon and then select Manage. Use the Manage tab to specify configurations such as data retention limits, promotion limits, Delta sharing, and access control for the dataset. Use the Edit data landing tab to specify how the dataset selects and transforms incoming events before storing them.
   Analytics table or Splunk index promoted from a raw table	Select the Actions () icon and then select Manage. You can specify Delta sharing and access control configurations for the dataset.

3. If you have the required permissions, you can delete a dataset by doing one of the following:
   • To delete a federated dataset, raw table, or promoted dataset, select it from the Datasets tab of the Catalog, then select the

     Actions () icon

     and Delete.
   • To delete a non-promoted Splunk index, use the Indexes page instead of the Catalog. For instructions, see Manage Splunk Cloud Platform indexes in the Splunk Cloud Platform Admin Manual.
   CAUTION: Before deleting a dataset, make sure that it is not being used as a dependency for any promoted datasets or knowledge objects such as reports, dashboards, and alerts.