Splunk Data Lake support

[ARC1]

Can you clarify Splunk Data Lake support around schema (schema-on-read vs enforced), available APIs for ingest/query, and how the LDP handles large-scale time-series data? Also interested in integration options and any FedRAMP considerations.

[ARC1]

What data schemas are supported in the Splunk Data Lake, and is the schema enforced, semi-structured, or schema-on-read? How are time-series fields normalized across different data sources? What APIs are available for data ingestion and extraction (REST, streaming, batch), and are there any API rate limits or throughput constraints? Can external tools query the data lake directly via API, and can Splunk federate queries to external object storage such as S3? How does Splunk LDP handle large-scale time-series data (e.g., 10 TB/day), including retention and tiering options, and how does it integrate with external data lakes or analytics platforms? What role-based access controls are supported for data lake access, is the Splunk Data Lake deployment FedRAMP authorized (and at what level), and how is audit logging handled for data access and schema changes?

[PickleRick]

1. What is the goal of those questions? You haven't just woken up one day and decided that you want to know "everything about Splunk" without actually learning Splunk.

2. Have you actually tried searching any of those things on your own? Where? What are your results? Do you have any doubts or don't understand something you'd already found?

Also - I'm merging your two separate threads about the same subject.

[livehybrid]

Hi @ARC1 

It seems like your questions would be better answered by Splunk's internal teams rather than the community due to the specific nature of the request. 

Do you already have a contact at Splunk that you can speak to? If not you might want to reach out via https://www.splunk.com/en_us/about-splunk/contact-us.html or speak to one of your local Splunk Partners (https://www.splunk.com/en_us/partners.html)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing