Manage table datasets

This topic covers functions of the Datasets listing page that are available to users of Splunk Enterprise deployments with the Splunk Datasets Add-on installed. The functions involve the creation and management of table datasets.

Splunk Cloud and Splunk Light implementations have the Splunk Datasets Add-on installed by default.

For information about default features of the Datasets listing page, such as accessing Explorer views of datasets, investigating datasets in Search, and visualizing datasets with Pivot, see Manage datasets.

Open the Datasets listing page

In the Search app, click Datasets in the green Apps bar.

Create table datasets

To create a table dataset, click Create New Table Dataset. This takes you to the initial data definition workflow. After you define initial data you can edit the dataset in the Table Editor.

See Define initial data for a new table dataset and Use the Table Editor.

Extend a dataset as a new table dataset

You can extend any dataset to a new table dataset. This means you are creating a new dataset that is bound to the original dataset through its reference to that dataset. If the definition of the parent dataset changes, those changes are passed down to any child datasets that are extended from it.

To see from what datasets a table dataset is extended, expand its row in the Datasets listing page by clicking its > symbol in the first column. The parent datasets for that dataset are listed in an Extends line item. If a table dataset does not have an Extends line item, it is not extended from another dataset.

Prerequisites

• Dataset extension
• Use the Table Editor

Steps

1. On the Datasets listing page, find a dataset that you want to extend.
2. For that dataset, select Manage > Extend in Table.
3. (Optional) Use the Table Editor to modify the new table.
4. Click Save As to open the Save As New Table dialog.
5. Enter a Table Title.
6. Click Save to save the table.

Clone a table dataset

Clone a table dataset to make a new table dataset that is a copy of an existing dataset. Cloning differs from dataset extension in that you can make changes to the original dataset without affecting datasets that are cloned from that dataset.

Table datasets are the only dataset type that can be cloned through the Datasets listing page. You can clone lookup definition datasets through the Lookup Definitions page in Settings.

Steps

1. On the Datasets listing page, find a table dataset that you want to copy.
2. Select Clone.
3. Enter a Table Title.
4. (Optional) Enter a Description.
5. Click Clone Dataset.
6. (Optional) Click Edit to edit your cloned dataset.
7. (Optional) Click Pivot to open the cloned dataset in Pivot and create a visualization based on it.

Edit a table dataset

Use the Datasets listing page to edit selected table datasets. You can edit a table description, or you can edit the table. If you want to edit the table you can do so with the Table Editor.

Add or edit a table dataset description

Table dataset descriptions are visible in two places:

• The Dataset listing page, when you expand the table dataset row.
• The Explorer view of the table dataset, under the dataset name.

Steps

1. On the Datasets listing page, find a table dataset whose description you would like to add or edit. Expand the dataset row by clicking the > symbol in the first column to see its current description.
2. Select Manage > Edit description.
3. Add or update the description.
4. Click Save.

Open a table dataset in the Table Editor

Use the Datasets listing page to open a dataset in the Table Editor.

See Use the Table Editor.

Steps

1. On the Datasets listing page, find a table dataset that you want to edit.
2. Select Manage > Edit table.
3. Edit the table in the Table Editor.
4. Click Save.

Update table dataset permissions

New table datasets are private by default. They are available only to the users who created them. If you want other users to be able to view or edit a private table dataset you can change its permissions.

By default, only the Power and Admin roles can set permissions for table datasets.

On the Datasets listing page, select Manage > Edit Permissions for the table whose permissions you want to edit. You can see whether the table is shared with users of a specific app, or globally with users of all apps. You can also see which roles have read or write access to the app.

For information about setting permissions, see Manage knowledge object permissions.

Share private table datasets that you do not own

If you want to share a private table dataset that you do not own, you can change its permissions though the Data Models management page in Settings. You cannot see private datasets that you do not own in the Datasets listing page.

Steps

1. Select Settings > Data models.
2. Locate the table dataset that you want to share and select Edit > Edit Permissions.
3. Share the dataset at the App or All apps level, and set read/write permissions as necessary.
4. Click Save.

When you return to the Datasets listing page you will see that the dataset is visible and has the new permissions that you set for it.

Manage table dataset acceleration

Table datasets that contain a large amount of data can be accelerated so that their underlying search completes faster when you view the dataset or visualizations that are backed by it. Table acceleration only applies to table datasets when the tstats or pivot commands are applied to them.

On the Datasets listing page, select Manage > Edit Acceleration for the table you want to accelerate.

On the datasets listing page, accelerated table datasets and data model datasets have a icon.

For more information about enabling and managing table acceleration, including caveats and restrictions related to table acceleration, see Accelerate tables.

Delete a table dataset

You can delete any table dataset that you have write permissions for.

Before deleting a table dataset, verify that it has not been extended to one or more child table datasets. Deletion of a parent dataset breaks tables and other objects that are extended from it. For example, if table Alpha is extended to table Beta, and table Beta is in turn used to create a Pivot visualization that is used in a dashboard panel, that dashboard panel will cease to function if you delete table Alpha.

See Dataset Extension

Prerequisites

See Disable or delete knowledge objects.

Steps

1. On the Datasets listing page, find the table dataset that you want to delete.
2. Select Manage > Delete.
3. Click Delete again to confirm.