Get started with table datasets
Table datasets are a type of dataset that you can create, shape, and curate for a specific purpose. You begin by defining the initial data for the table, such as an index, source type, search string, or existing dataset. Then you edit and refine that table until it fits the precise shape that you and your users require for later analysis and reporting work.
After you create your table, you can modify it over time and share it with others so they can refine it further. You can also use techniques like dataset cloning and dataset extension to create datasets that are based on datasets you already created.
You can manage table datasets alongside other dataset types that are available to all users of Splunk Enterprise and Splunk Cloud Platform, like data model datasets and lookups. All of these dataset types appear in the Datasets listing page.
What you can do with datasets
This table explains what Splunk platform users can do with datasets.
Dataset activity | Why this is useful | See also |
---|---|---|
View dataset contents | Check a dataset to determine whether it contains fields and values that you want to work with. For example, you can view lookup table files directly instead of searching their contents in the Search view. | Manage table datasets |
Open datasets in Pivot | Use Pivot to create visualizations and dashboard panels based on your dataset. Pivot can also help you discover data trends and field correlations within a dataset. | Introduction to Pivot |
Extend datasets | Extend your dataset as a search, modify its search string as necessary, and save the search as a report, alert, or dashboard panel. You can also create table datasets that are based on lookups and data model datasets and then modify those tables to fit your specific use cases. | Dataset extension |
Use Table Views to create table datasets | You can design sophisticated and tightly-focused collections of event data, even with minimal SPL skills. | Define initial data for a new table dataset |
Share table datasets | After you create a table dataset you can give other users read or write access to it so they can curate and refine it. You can also extend your dataset and let other people refine the extension without affecting the original dataset. | Manage table datasets |
View field analytics | View field analytics in Table Views Summary mode to find more detailed information about your dataset. | Define initial data for a new table dataset |
Clone table datasets | You can make exact copies of table datasets and save the copy with a new name. Only table datasets can be cloned. | Manage datasets |
Accelerate table datasets | You can accelerate table datasets to return results faster in a manner similar to report and data model acceleration. This can be helpful if you are using a large dataset as the basis for a pivot report or dashboard panel. | Accelerate table datasets |
Explore a dataset | Manage table datasets |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.3.2408, 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release)
Feedback submitted, thanks!