Query and access Machine Data Lake data
Choose the supported query or access path for a raw table, Splunk index, analytics table, Open Sharing client, or external Spark workflow.
For general guidance about starting a search from the Catalog and continuing in the Search & Reporting app, see Search, transform, and analyze your data. Use this topic to understand the Machine Data Lake-specific behavior for each dataset type.
Raw search
Raw search is useful for validating that landed data exists and for narrowing the next action. Raw tables are storage-optimized, not search-optimized, so raw search might not provide the performance or field behavior required for repeated operational searches.
The search experience can warn that raw search can be costly before it opens raw search. Proceed when raw search is the right validation path and, where supported, choose not to show the warning again.
Raw search supports the Machine Data Lake metadata fields documented for the raw table search surface, including source, sourcetype, host, and time. Do not assume that derived or implicitly extracted fields are available unless the raw-search documentation lists them. When the use case requires indexed search, dashboards, alerts, lookups, or correlation, promote the required data to a Splunk index. When it requires a defined schema for structured analytics, promote the required data to an analytics table. Do not search the full raw table by default.Analytics search
Use analytics search when a static promotion has created an analytics table for a specific historical time range. An analytics table uses the exact schema defined during promotion, including fields extracted from raw data or shaped with custom SPL2.
Choose this path when you know which fields you need. Select only those fields during promotion so the table stays focused and easier to search. Because analytics tables use a columnar format, you can scan selected fields across large data volumes more efficiently than you can scan full raw events.
Use analytics tables for work such as threat hunting, compliance reports, audit review, trend analysis, large-scale aggregation, and machine learning training. For example, you can promote one month of process logs with only the fields you need for command-line analysis, or promote audit events with the fields required for a compliance report.
If Open Sharing is supported for your environment and dataset type, you can share an analytics table with authorized tools or workflows outside Splunk. Use Open Sharing when a business intelligence tool, notebook, or machine learning pipeline needs read-only access to the promoted data without a manual export.
Before you create the promotion, confirm the time range, filters, and fields that your work requires. Select only the fields that support your analysis.
This search path depends on modules for Search Processing Language version 2 (SPL2) and on data orchestration services. Search availability depends on those services being available and healthy.
Splunk search
Use Splunk search for a promoted Splunk index. Open the supported Splunk search surface from the Catalog or the promotion job details, and use the search syntax documented for that surface.