Promote data to an analytics table

Create a static analytics table promotion from selected data in a Machine Data Lake raw table.

1. From the global navigation bar in Splunk Cloud Platform, select the Catalog () icon.
2. On the Catalog page, use the Datasets tab to find the raw table that contains the data you want to promote.

   You can search, filter by time range, sort table columns, or move through pages of datasets.

3. Select the raw table and then select Promote.

   The promotion workflow opens for the selected dataset.

4. On the Configure step, select Static promotion to an analytics table.

   Use this promotion type only when the target needs a bounded historical range with an explicit structured schema. If the data needs Splunk search, dashboards, alerts, scheduled searches, monitoring, or correlation, promote data to a Splunk index instead, see Promote data to a Splunk index.

5. Set the historical time range that contains the data you need in the analytics table.

   Use a preset, relative range, date range, date and time range, or advanced earliest and latest values. Keep the range focused so the promotion includes only relevant data and enough representative events to extract the required fields.

6. (Optional) To narrow the promotion to specific events, select Add filter.

   Choose a field such as host, sourcetype, or source, and enter the value that identifies the events to include. Add more filters to narrow the data further, or remove a filter that you no longer need.

7. Select Next.
8. On the Preview page, select Extract fields from raw.

   Field extraction creates candidate fields from representative raw events in the selected time range. If the extraction does not find a required field, use custom SPL2 when needed to extract the field or shape the schema.

9. Review the extracted fields.

   Keep only the fields that the analytics table must contain. Remove fields that are not needed for the analytics workflow, and confirm that the retained fields use clear names and expected values.

10. Define the exact output schema for the analytics table.

    Confirm each field name, field type, and output shape before you create the table. The schema controls how users query the promoted analytics table after the promotion completes.

11. When required fields are missing or the output schema needs additional shaping, turn on SPL2 editor and add custom SPL2.

    Use custom SPL2 to extract fields from _raw, rename fields, cast values, or shape the table schema when the field extraction output is not sufficient.

    Important: Don't use lookup-based processing in Machine Data Lake promotion workflows. Lookup actions and SPL2 processing that references lookups are not supported for static promotion to an analytics table.
12. Select the Run () icon or press Control+Enter to preview the analytics table output.

    Validate that the preview includes the expected rows, excludes unwanted events, and shows the exact fields and types that the analytics workflow requires.

13. Revise the time range, filters, extracted fields, schema, or custom SPL2 until the preview matches the analytics table you intend to create.

    Run preview again after each change. Do not continue until the preview output matches the required schema and representative rows.

14. When the preview matches the analytics table you want to promote, select Next.
15. On the Review and finalize page, enter a unique promoted dataset name and optional description.

    Use a name and description that help you and your team understand what the analytics table contains, which raw table it came from, and which schema it uses.

16. Review the Promotion job summary and dataset summary sections.
17. Select Start promotion.
    Machine Data Lake creates a promotion job and opens the promotion job list in the Catalog Promotion jobs tab.