Manage table datasets
This topic covers functions of the Datasets listing page that are available to users of Splunk Enterprise deployments with the Splunk Datasets Add-on installed. The functions involve the creation and management of table datasets.
Splunk Cloud and Splunk Light implementations have the Splunk Datasets Add-on installed by default.
For information about default features of the Datasets listing page, such as accessing Explorer views of datasets, investigating datasets in Search, and visualizing datasets with Pivot, see Manage datasets.
Open the Datasets listing page
In the Search app, click Datasets in the green Apps bar.
Create table datasets
To create a table dataset, click Create New Table Dataset. This takes you to the initial data definition workflow. After you define initial data you can edit the dataset in the Table Editor.
Extend a dataset as a new table dataset
You can extend any dataset to a new table dataset. This means you are creating a new dataset that is bound to the original dataset through its reference to that dataset. If the definition of the parent dataset changes, those changes are passed down to any child datasets that are extended from it.
To see from what datasets a table dataset is extended, expand its row in the Datasets listing page by clicking its > symbol in the first column. The parent datasets for that dataset are listed in an Extends line item. If a table dataset does not have an Extends line item, it is not extended from another dataset.
- On the Datasets listing page, find a dataset that you want to extend.
- For that dataset, select Manage > Extend in Table.
- (Optional) Use the Table Editor to modify the new table.
- Click Save As to open the Save As New Table dialog.
- Enter a Table Title.
- Click Save to save the table.
Clone a table dataset
Clone a table dataset to make a new table dataset that is a copy of an existing dataset. Cloning differs from dataset extension in that you can make changes to the original dataset without affecting datasets that are cloned from that dataset.
Table datasets are the only dataset type that can be cloned through the Datasets listing page. You can clone lookup definition datasets through the Lookup Definitions page in Settings.
- On the Datasets listing page, find a table dataset that you want to copy.
- Select Clone.
- Enter a Table Title.
- (Optional) Enter a Description.
- Click Clone Dataset.
- (Optional) Click Edit to edit your cloned dataset.
- (Optional) Click Pivot to open the cloned dataset in Pivot and create a visualization based on it.
Edit a table dataset
Use the Datasets listing page to edit selected table datasets. You can edit a table description, or you can edit the table. If you want to edit the table you can do so with the Table Editor.
Add or edit a table dataset description
Table dataset descriptions are visible in two places:
- The Dataset listing page, when you expand the table dataset row.
- The Explorer view of the table dataset, under the dataset name.
- On the Datasets listing page, find a table dataset whose description you would like to add or edit. Expand the dataset row by clicking the > symbol in the first column to see its current description.
- Select Manage > Edit description.
- Add or update the description.
- Click Save.
Open a table dataset in the Table Editor
Use the Datasets listing page to open a dataset in the Table Editor.
See Use the Table Editor.
- On the Datasets listing page, find a table dataset that you want to edit.
- Select Manage > Edit table.
- Edit the table in the Table Editor.
- Click Save.
Update table dataset permissions
New table datasets are private by default. They are available only to the users who created them. If you want other users to be able to view or edit a private table dataset you can change its permissions.
By default, only the Power and Admin roles can set permissions for table datasets.
On the Datasets listing page, select Manage > Edit Permissions for the table whose permissions you want to edit. You can see whether the table is shared with users of a specific app, or globally with users of all apps. You can also see which roles have read or write access to the app.
For information about setting permissions, see Manage knowledge object permissions.
If you want to share a private table dataset that you do not own, you can change its permissions though the Data Models management page in Settings. You cannot see private datasets that you do not own in the Datasets listing page.
- Select Settings > Data models.
- Locate the table dataset that you want to share and select Edit > Edit Permissions.
- Share the dataset at the App or All apps level, and set read/write permissions as necessary.
- Click Save.
When you return to the Datasets listing page you will see that the dataset is visible and has the new permissions that you set for it.
Manage table dataset acceleration
Table datasets that contain a large amount of data can be accelerated so that their underlying search completes faster when you view the dataset or visualizations that are backed by it. Table acceleration only applies to table datasets when the
pivot commands are applied to them.
On the Datasets listing page, select Manage > Edit Acceleration for the table you want to accelerate.
For more information about enabling and managing table acceleration, including caveats and restrictions related to table acceleration, see Accelerate tables.
Delete a table dataset
You can delete any table dataset that you have write permissions for.
Before deleting a table dataset, verify that it has not been extended to one or more child table datasets. Deletion of a parent dataset breaks tables and other objects that are extended from it. For example, if table Alpha is extended to table Beta, and table Beta is in turn used to create a Pivot visualization that is used in a dashboard panel, that dashboard panel will cease to function if you delete table Alpha.
- On the Datasets listing page, find the table dataset that you want to delete.
- Select Manage > Delete.
- Click Delete again to confirm.
Table datasets and the Splunk Datasets Add-on
Define initial data for a new table dataset
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 8.0.0