Platform: Federated Data Management

adepp — Mon, 23 Mar 2026 19:51:51 GMT

Register/Watch OnDemand here. This thread is for the Community Office Hours session on Platform: Federated Data Management on Wed, June 18, 2025 at 1pm PT / 4pm ET.

Ask the experts at Community Office Hours! An ongoing series where technical Splunk experts answer questions and provide how-to guidance on various Splunk product and use case topics.

What can I ask in this AMA?

How do Data Management, Federated Search, and Federated Analytics work together? Can I get a demo?
How can I optimize my data design according to its use case (detection, investigation, threat hunting, compliance, etc.)?
How does Splunk enable data federation across Amazon Security Lake and S3? What tools are available to me?
How can I onboard data from any data store or end points?
How can I start filtering and routing data with Edge Processor or Ingest Processor?
How can I optimize my Edge Processor or Ingest Processor pipelines?
Anything else you’d like to learn!

Please submit your questions at registration. You can also head to the #office-hours user Slack channel to ask questions (request access here).

Pre-submitted questions will be prioritized. After that, we will open the floor up to live Q&A with meeting participants.

Look forward to connecting!

Re: Platform: Federated Data Management

adepp — Wed, 25 Jun 2025 20:40:46 GMT

Hi everyone! Here are a few questions from the session (get the full Q&A deck and live recording in the #office-hours Slack channel - request access here) :

Q1: How does Splunk enable data federation across Amazon Security Lake and S3? What tools are available to me?

FS-S3 + FA-ASL
Runs on Splunk Cloud
Set up Federated Search for infrequent, ad-hoc quering
- Glue table + resource share from AWS
- search using sdselect
Set up Data Lake Indexing for frequent querying and ES use cases

Q2: How is the Amazon S3 data searched through Splunk?

To access S3 data today, customers need to use the new SPL command ‘sdselect’, which follows a SQL-like syntax.
In the future, ‘sdselect’ will be replaced with SPL2.
sdselect command syntax

Q3: How do I forward my logs to Edge Processor once I’ve successfully configured it? Script is showing as healthy.

Edge Processor supports a variety of data sources including:
- Forwards (Splunk2Splunk)
- HTTP Event Collector (HEC)
- Syslog
Get data from a forwarder into an Edge Processor
Get data into an Edge Processor using HTTP Event Collector
Get syslog data into an Edge Processor

Other Questions (check the #office-hours Slack channel for responses):

How do Data Management and Federation work together?
How can I optimize DSU consumption for FS-S3 use case?
Datamodel Acceleration via Federated Search
AWS S3 Replay in Splunk Cloud

rss.livelink.thread@place:occasion

Platform: Federated Data Management

Re: Platform: Federated Data Management