Built-in datasets

The Splunk platform comes with a set of built-in datasets that you can use. For example, there are default datasets for event and metric data, as well as catalog datasets which store metadata about datasets, source types, sources, hosts and other knowledge objects.

The following table describes the built-in datasets:

Built-in datasets	Dataset kind	Description
main	index	The default index for events that are ingested into the Splunk platform.
metrics	metric	The default index for metrics that are ingested into the Splunk platform.
geo.hex	lookup	Use this lookup dataset to map locations to hexagonal coordinate systems, typically to render on a geographic map.
geo.iplocation	lookup	Use this lookup dataset to map an IP address to a physical location. Using this dataset in SPL2 is similar to using the iplocation command in SPL.
catalog.*	catalog	Datasets in the catalog module are always referred to by the module name followed by the dataset name, using the syntax <module-name>.<dataset-name>. Use these datasets to read information in the Metadata Catalog service using SPL2. For example, catalog.datasets is a dataset in the catalog module that contains metadata about all of the datasets known to the Metadata Catalog service.
catalog.metrics	catalog	This dataset is in the catalog module. Use this dataset to find metadata about the content of any metrics indexes. Searching the catalog.metrics dataset with the SPL2 FROM command is like using the mcatalog command in SPL.
catalog.sourcetypes catalog.sources catalog.hosts	splv1source	These datasets are in the catalog module. Use these datasets to read metadata about the source types, sources, or hosts found in indexes that you have access to. Searching these datasets in SPL2 is like using the metadata command in SPL.
ingest.events	splv1sink	This dataset is in the ingest module. Use this dataset to write information to the Splunk Data Stream Processor (DSP) pipelines for ingesting events.
ingest.metrics	splv1sink	This dataset is in the ingest module. Use this dataset to write information to the Splunk DSP pipelines for ingesting metrics.

See also

Related information

Datasets

Dataset literals

Dataset functions