Splunk® Enterprise

Knowledge Manager Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

View and manage datasets

Use the Datasets listing page to view and manage your datasets. The Datasets listing page lets you perform the following tasks.

  • View datasets
  • Open datasets in Pivot
  • Explore datasets in Search
  • Edit datasets in their native editing environments
  • Manage permissions for lookups and table datasets
  • Delete datasets

If you use Splunk Enterprise, you can do more with the Datasets listing page if you have installed the Splunk Datasets Add-on. Splunk Cloud users get this add-on by default. See Table datasets and the Table Editor.

View a dataset

View a dataset to see its structure and determine whether it contains the information you want to work with. Datasets are presented as tables, with fields as columns and values in cells. Data model datasets and table datasets display events as rows. Lookups display records as rows.

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page.
  2. Locate a dataset you want to inspect.
  3. (Optional) Click the > symbol to expand the row of the dataset and reveal dataset detail information. You can review a list of the fields contained in the dataset without going to the viewing page.
  4. Click the dataset name to see its structure and contents in the dataset viewing page.

From the viewing page you can perform all of the actions for the dataset that you might otherwise perform on the listing page. You can manage permissions, edit the dataset description, open the dataset in Pivot, and so on.

Open a dataset in Pivot

The Pivot tool lets you create dataset-backed reports and dashboard panels without any interaction with the Splunk Search Processing Language (SPL). You can use its drag-and-drop UI to design sophisticated tables, charts, and visualizations that reveal trends and patterns in your datasets.

You can open all dataset types in Pivot.

  • When you are on the Datasets listing page, click Pivot to open a dataset in Pivot and begin designing a table or visualization based upon it.
  • When you are viewing a dataset, click Pivot to open the dataset in Pivot.
  • If you use Splunk Cloud, or use Splunk Enterprise and have installed the Splunk Datasets Add-on, you can open table datasets in Pivot from the Table Editor as well.

For more information about using Pivot to create dataset-backed reports and dashboard panels, see Introduction to Pivot in the Pivot Manual.

Explore a dataset in Search

You can explore the contents of a dataset in the Search view. When you click Explore in Search for a dataset, the Search view opens with a search string that uses the from command to reference that dataset. The results returned by this search provide a view into the contents of the dataset.

You can save this search as a report, alert, or dashboard panel. The saved dataset is considered to be extended from the original dataset. An extended dataset is distinct from, but dependent to, the parent dataset that it was extended from. If you change a parent dataset, that change propagates down to all datasets that you have extended from that parent dataset.

Prerequisites

For more information about the mechanics and consequences of dataset extension, see Extend datasets.

Steps

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page..
  2. Locate a dataset that you want to explore in Search.
  3. (Optional) Click the name of the dataset to view it in the viewing page.
  4. Click Explore in search.
    The search returns results in event list format by default. Switch the display format to Table to see the table view of the dataset.
  5. (Optional) Update the search string with additional SPL. Do not remove the from reference.
  6. (Optional) Click Save as to save your search, and select either Report, Dashboard Panel, or Alert.
  7. (Optional) Click New Table to create a new table dataset based on the search string.
    This option is available only if you are a Splunk Cloud user or if you use Splunk Enterprise and have installed the Splunk Datasets Add-on.

Edit datasets

From the Datasets listing page and dataset viewing pages, you can click through to the editing workflows for lookups and data model datasets.

You cannot create or edit table datasets unless you are a Splunk Cloud user or you use Splunk Enterprise and have installed the Splunk Datasets Add-on.

Edit lookup table files

Prerequisites

See Use field lookups to add information to your events to learn about managing lookup table files in Settings.

Steps

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page.
  2. Locate a lookup table file that you want to edit.
  3. (Optional) Click the name of the lookup table file to view it in the dataset viewing page.
  4. Select Manage > Edit Lookup Table File. This opens a Settings page that lists the lookup table files that are uploaded to your Splunk platform implementation.
  5. (Optional) Update the permissions of the file.
  6. (Optional) Move lookup table files to a different app context.
  7. (Optional) Delete lookup table files.
  8. (Optional) Upload new .csv lookup table files.

Edit lookup definitions

The Datasets listing page lists all of the .csv lookup definitions and KV Store lookup definitions in your Splunk implementation.

Prerequisites

See Use field lookups to add information to your events to learn about editing lookup definitions in Settings.

Steps

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page..
  2. Locate a lookup definition that you want to edit.
  3. (Optional) Click the name of the lookup definition to view it in the dataset viewing page.
  4. Select Manage > Edit Lookup Definition. This opens the Settings page for the lookup definition.
  5. (Optional) Update the lookup definition. You can change the fields it matches, configure it to be time-based, and set up advanced field-matching rules.

Data model datasets

Prerequisites

See Design data model datasets to learn more about using the Data Model Editor to update data models and their datasets.

Steps

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page.
  2. Locate a data model dataset that you want to edit.
  3. (Optional) Click the name data model dataset to view it in the dataset viewing page.
  4. Select Manage > Edit Data Model. This opens the data model dataset in the Data Model Editor.
  5. (Optional) Use the Data Model Editor to update the constraints and attributes (fields) for the data model dataset.

Manage dataset permissions

Change dataset permissions to widen or restrict their availability to other users. You can set up read and write access by role, and you can determine whether datasets are globally accesible, restricted to a particular app context, or private to a single user.

For an overview of how the Splunk platform permissions features work, see Manage knowledge object permissions.

Lookups and table datasets

You can set permissions for lookups and table datasets directly through the Datasets listing page.

When you set permissions for a lookup table file, its permissions should be scoped in a way that makes it usable by any lookup definitions that you associate with it. For example, if a lookup table file has permissions that are scoped to a specific app, this is fine, as long as any lookup definitions that use that lookup table file also have permissions scoped to that app. If you want to associate that lookup table file with lookup definitions that are scoped to a different app, or that have global permissions, you will want to ensure the lookup table file has permissions scoped to "all apps." If you do not do this, the lookup may not work for some users.

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page.
  2. Locate a lookup or table dataset for which you need to view or update permissions.
  3. Select Manage > Edit Permissions.
  4. (Optional) Change the audience that you want the dataset to Display for.
    Option Definition
    Private The lookup or table dataset is only available to the person who created it.
    App The lookup or table dataset has its permissions scoped to a single app. Users in other app contexts will be unable to see it or use it.
    All apps The lookup or table dataset has its permissions scoped to all apps. This means it has global availability to all users of your Splunk implementation.
  5. (Optional) If the dataset displays for an App or All apps, you can change the Read and Write settings that determine which roles can view or edit the dataset.
  6. Click Save to save your changes, or Cancel if you decide not to make any changes.

Data model datasets

Permissions for data model datasets are set at the data model level. All datasets within a data model have the same permissions settings. There are two ways to set permissions for data models:

  • Through the Data Model Editor
  • Through the Data Models listing page in Settings

Prerequisites

Learn about setting data model permissions in Manage data models.

Steps for setting data model dataset permissions with the Data Model Editor

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page..
  2. Identify the data model dataset for which you want to update permissions.
  3. Select Manage > Edit data model.
  4. Select Edit > Edit permissions to set permissions for the data model that your selected data model dataset belongs to.
  5. (Optional) Change the audience that you want the data model to Display for. It can display for users of a specific App or users of All apps.
  6. (Optional) If the data model displays for an App or All apps, you can change the Read and Write settings that determine which roles can view or edit the data model.
  7. Click Save or Cancel.

Steps for setting data model dataset permissions with the Data Models listing page in Settings

  1. Select Settings > Data models.
  2. Identify the data model for which you would like to change permissions.
  3. Select Edit > Edit permissions to set permissions for the data model that your selected data model dataset belongs to.
  4. (Optional) Change the audience that you want the data model to Display for. It can display for users of a specific App or users of All apps.
  5. (Optional) If the data model displays for an App or All apps, you can change the Read and Write settings that determine which roles can view or edit the data model.
  6. Click Save or Cancel.

Delete datasets

You can delete lookups and table datasets through the Datasets listing page. You can delete a data model dataset from the Data Model editor.

Lookups and table datasets

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page..
  2. Locate a lookup or table dataset that you want to delete.
  3. Select Manage > Delete.
  4. On the Delete Dataset dialog, clickDelete again to verify that you want to delete the dataset.

You can also delete lookups and tables from their dataset viewing pages.

Data model datasets

  1. In the Search & Reporting app, click Datasets to open the Datasets listing page..
  2. Locate a data model dataset that you want to delete.
  3. Select Manage > Edit Dataset.
  4. In the Data Model Editor, click Delete for the data model dataset.

If you have the Splunk Datasets Add-on

If you have the Splunk Datasets Add-on you can do more with the Datasets listing page.

  • Access the Table Editor to create new table datasets.
  • Edit table datasets in the Table Editor.
  • Extend any dataset as a new table dataset.
  • Clone table datasets.

See Table datasets and the Splunk Datasets Add-on.

PREVIOUS
Dataset types and usage
  NEXT
Table datasets and the Splunk Datasets Add-on

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters