Splunk® Enterprise

Knowledge Manager Manual

Get started with table datasets

Table datasets are a type of dataset that you can create, shape, and curate for a specific purpose. You begin by defining the initial data for the table, such as an index, source type, search string, or existing dataset. Then you edit and refine that table until it fits the precise shape that you and your users require for later analysis and reporting work.

After you create your table, you can modify it over time and share it with others so they can refine it further. You can also use techniques like dataset cloning and dataset extension to create datasets that are based on datasets you already created.

You can manage table datasets alongside other dataset types that are available to all users of Splunk Enterprise and Splunk Cloud Platform, like data model datasets and lookups. All of these dataset types appear in the Datasets listing page.

What you can do with datasets

This table explains what Splunk platform users can do with datasets.

Dataset activity Why this is useful See also
View dataset contents Check a dataset to determine whether it contains fields and values that you want to work with. For example, you can view lookup table files directly instead of searching their contents in the Search view. Manage table datasets
Open datasets in Pivot Use Pivot to create visualizations and dashboard panels based on your dataset. Pivot can also help you discover data trends and field correlations within a dataset. Introduction to Pivot
Extend datasets Extend your dataset as a search, modify its search string as necessary, and save the search as a report, alert, or dashboard panel. You can also create table datasets that are based on lookups and data model datasets and then modify those tables to fit your specific use cases. Dataset extension
Use Table Views to create table datasets You can design sophisticated and tightly-focused collections of event data, even with minimal SPL skills. Define initial data for a new table dataset
Share table datasets After you create a table dataset you can give other users read or write access to it so they can curate and refine it. You can also extend your dataset and let other people refine the extension without affecting the original dataset. Manage table datasets
View field analytics View field analytics in Table Views Summary mode to find more detailed information about your dataset. Define initial data for a new table dataset
Clone table datasets You can make exact copies of table datasets and save the copy with a new name. Only table datasets can be cloned. Manage datasets
Accelerate table datasets You can accelerate table datasets to return results faster in a manner similar to report and data model acceleration. This can be helpful if you are using a large dataset as the basis for a pivot report or dashboard panel. Accelerate table datasets
Last modified on 14 October, 2021
Explore a dataset   Manage table datasets

This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6, 9.0.8, 9.0.7, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.0.4, 9.2.0, 9.2.1

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters