Inspect and edit raw tables

Inspect a Machine Data Lake (MDL) raw table and update its management settings or data landing definition.

1. Open Data Management app and select Datasets.
2. Select the raw table that you want to inspect or edit.

   Use the search field to filter the dataset list. The dataset details panel shows general dataset information, event summary, field summary, and promotion jobs.

3. Open the raw table details page.

   From the dataset details panel, select the more icon, and then select Manage. The raw table details page opens.

4. Choose an action for the raw table.
   • To promote data from the raw table, select Promote.
   • To search the raw table, select Search. Searching raw tables can use more compute than searching promoted data, and only a limited set of fields is searchable. For better search performance, promote the data before you search.
   • To delete the dataset, select Delete. Confirm the deletion when prompted.
   • To review dataset metadata and related promotion jobs, select the Overview tab.
   • To update dataset management settings, select the Manage tab.
   • To update the data landing definition, select the Edit data landing tab.
5. (Optional) On the Overview tab, review the raw table details.

   The Overview tab shows general information, data retention, fields, and related promotion jobs. To refresh the list of related promotion jobs, select Refresh jobs.

6. (Optional) On the Manage tab, update the dataset management settings.

   You can update Open Sharing settings, dataset description, data retention, promotion limits, and access control settings.

   1. (Optional) In the External sharing section, select an expiration period, and then select Enable sharing.

      Open Sharing makes the dataset available as read-only, zero-copy data by using Delta Sharing. For more information, see Read Delta Sharing Tables.

   2. (Optional) In Dataset description, enter or update the dataset description.
   3. In Data retention for raw table, enter how long to keep data in the raw table, and then select the time unit.
   4. In the Promotion limits section, enter the maximum rolling window for streaming promotions, and then select the time unit.

      Data outside the rolling window is removed from the promoted destination. This setting doesn't affect the source raw table retention period.

   5. Enter the default retention period for static promotions, and then select the time unit.

      This setting controls the retention period for all promotion targets created by static promotion created from the raw table.

   6. (Optional) In the Access control section, add roles or accounts that need dataset-specific access.

      Select one or more roles or accounts from Add roles and users, select the add icon, and then select an access level for each role or account. Default access control is inherited from capabilities and policies.

   7. Select Save.
   The raw table management settings are updated.
7. (Optional) On the Edit data landing tab, update the data landing definition.

   You can add partitions, add sample data, add actions, review fields, preview the landing definition, or turn on SPL editor, the Search Processing Language (SPL) editor, to view or edit the landing definition as Search Processing Language version 2 (SPL2). Partitions and actions affect preview results and the data written to the raw table after the landing definition is saved.

   Use Edit data landing to change which events from an existing supported HEC, Universal Forwarder, or Heavy Forwarder path to a Splunk index land in this raw table. Update partition conditions by source, sourcetype, or host. With MDL-only routing, matching events are redirected to the raw table instead of the existing index. With dual routing, matching events land in the raw table and continue to the existing index. Events that do not match the partition conditions continue to their configured destination. Before you save changes, preview representative matching and non-matching events and confirm the expected routing behavior. Keep enough information about the previous definition to restore it if the updated configuration does not behave as expected.

   1. (Optional) In the Partition section, add or update partitions by sourcetype, source, or host.

      Use the IN operator and enter or select at least one non-empty value for each partition. Data that does not match the partition conditions follows the configured non-matching destination for the pipeline. For more information, see How data moves through the Ingest Processor solution.

   2. (Optional) Select Add sample data, enter or upload representative sample data, and then select Apply.

      Use sample data in the same format as the events that you want to land. Include events with the source, sourcetype, and host values that you use in the landing definition. For more information, see Create pipelines for Ingest Processor.

   3. (Optional) In the Actions section, add or update actions that filter, mask, or process matching events.

      Use Filter values to filter events by matching values. Use Mask values in _raw to replace matching values in the _raw field before events land in the raw table. Use Apply custom command function to apply a published custom command function to matching events. For more information, see Filter and mask data using Ingest Processor and Create and apply a custom command function for the Ingest Processor solution.

   4. Select Preview to confirm that the results match the events that you want to land.

      If you edit the Search Processing Language version 2 definition, run preview again to confirm the results before you save.

   5. Select Save.
   The raw table landing definition is updated. Matching data continues to land in Machine Data Lake according to the saved definition.