Choose how to route data to Machine Data Lake

Choose how to route matching events into a Machine Data Lake raw table and when to preserve or create a Splunk index path.

Use this topic after you decide that a source fits Machine Data Lake (MDL) and before you change input configuration or edit a raw table landing definition. The routing option you choose depends on where you can safely make the routing change and whether matching events must also remain available in an existing or promoted Splunk index path.

Data landing is the step that selects matching incoming events and writes them to a Machine Data Lake raw table. After data lands, use the Catalog to validate, search, promote, share, or manage the data.

Start with two routing decisions

  1. Decide whether you can change the upstream client configuration. If you can change the Universal Forwarder, Heavy Forwarder, or HTTP Event Collector (HEC) client path, you can route directly to the raw table from the source configuration. If you cannot change the client path, use the raw table landing definition to select matching events that are already reaching Splunk Cloud Platform.

  2. Decide whether matching events must also continue to a Splunk index path. Use Machine Data Lake-only routing when the matching events do not need an existing index. Use the HEC two-request model when an HEC client can send the same event separately to MDL and to a Splunk index. Use the Ingest Processor preservation model when a raw table landing definition selects events from an existing index route and the index route must continue. Use streaming promotion only after data lands, when matching new events must continue into a promotion-managed Splunk index.

Choose where to control routing

Change a forwarder input

Use this option when you can update Universal Forwarder or Heavy Forwarder input configuration through your normal change process. The input identifies the Machine Data Lake raw table resource name, such as ~.federated.<raw_table_name>, and the existing Splunk Cloud output configuration continues to be used.

For step-by-step instructions, see Route Universal Forwarder data directly to Machine Data Lake or Route Heavy Forwarder data directly to Machine Data Lake.

Change an HEC token

Use this option when applications, cloud services, scripts, or integrations send events through HEC and the HEC client can use an HEC token that targets the raw table resource name, such as ~.federated.<raw_table_name>. This option is usually best when token rotation is easier than changing a landing definition or forwarder configuration.

For step-by-step instructions, see Route HEC events directly to Machine Data Lake.

Edit the raw table landing definition

Use this option when events from supported HEC clients, Universal Forwarder, Heavy Forwarder, or OpenTelemetry Collector pipelines already reach Splunk Cloud Platform and you do not want to change upstream clients. The landing definition selects matching events by values such as source, sourcetype, or host, and non-matching events follow their configured destination.

For step-by-step instructions, see Create a Machine Data Lake raw table or Inspect and edit raw tables.

Choose the Splunk index behavior

Land only in Machine Data Lake

Use Machine Data Lake-only routing when matching events do not need to remain immediately searchable in an existing Splunk index. Matching events are redirected to the raw table, and the raw table becomes the source for validation, raw search, promotion, sharing where supported, and retention controls.

Preserve an existing Splunk index path during landing

Use this option when current Splunk searches, dashboards, alerts, Enterprise Security content, or rollback plans must continue using an existing index while matching events also land in Machine Data Lake. For HEC clients, send the same event separately with the Machine Data Lake HEC token and the HEC token for the Splunk index. For a raw table landing definition, create and activate an Ingest Processor pipeline with the same matching condition and a Splunk index destination for the preserved index. Validate the Machine Data Lake route and the preserved index route separately.

For step-by-step instructions, see Send HEC events to Machine Data Lake and a Splunk index or Preserve a Splunk index path when using a data landing definition.

Use streaming promotion to create an index path after landing

Use streaming promotion when matching new events that already land in a raw table must continue flowing into a promotion-managed Splunk index for monitoring, alerting, dashboards, or high-performance search. Streaming promotion is a post-landing consumption path, not the first step for getting events into Machine Data Lake.

Validate the chosen route

Validate the complete route before you rely on it for production retention, search, promotion, sharing, or downstream analytics.

  • Preview representative matching and non-matching sample events before you save a landing definition or processing change.

  • Send a uniquely identifiable test event, such as an event that contains mdl_test_id=<unique_test_id>, through the selected input path.

  • Search or inspect the raw table for the unique test value by using a narrow time range and known source, sourcetype, or host values.

  • If you preserve an existing Splunk index path or configure streaming promotion, verify the same test event in the expected Splunk index path.

  • Confirm that representative non-matching events do not land in the raw table and continue to the intended default or preserved destination.

  • Use preview, raw search, or index search for immediate validation. Catalog metadata, event ranges, field summaries, and dataset statistics can refresh later.