Splunk® Light

Getting Started Manual

Download manual as PDF

Download topic as PDF

View and manage datasets in Splunk Light

The Datasets listing page gives you a high-level view of all of the datasets that you have access to in your Splunk implementation. You can see what types of datasets you have, who owns them, and how they're shared.

This topic covers the default capabilities of the Datasets listing page. By default you can use it to:

  • Access dataset Explorer views
  • Edit datasets in their native editing environments
  • Visualize datasets in Pivot
  • Investigate datasets in Search
  • Manage dataset permissions
  • Delete lookup table files and lookup definitions

View dataset detail information

Expand a dataset row to see detailed information about that dataset, such as the fields contained in the dataset or the date the dataset was last modified.

This image displays the expanded row for a table dataset named Webstore Purchases.

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Find a dataset you want to explore.
  3. Click the > symbol to expand the row of the dataset and reveal dataset detail information. You can review a list of the fields contained in the dataset without going to the viewing page.
  4. (Optional) Click Edit to change the dataset permissions.

See Manage dataset permissions in this topic.

Access the Explorer view of a dataset

Use the Explorer view to see the dataset structure and determine whether it contains information you want to work with. You can also use this view to:

  • See what datasets contain for specific time ranges.
  • Export dataset contents to a CSV file.
  • Save datasets as scheduled reports.
  • Carry out other functions that are present in the Datasets listing page, such as managing dataset acceleration, setting dataset permissions, and opening datasets in Search and Pivot.

The Explorer view presents datasets as tables, with fields as columns and values in cells. Data model datasets and table datasets display events as rows. Lookups display their records as rows.

Prerequisites

Learn what you can do with your datasets in the Explorer view. See Explore a dataset in Splunk Light in this manual.

Steps

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Find a dataset you want to explore.
  3. (Optional) Click the > symbol to expand the row of the dataset and reveal dataset detail information. You can review a list of the fields contained in the dataset without going to the viewing page.
  4. Click the dataset name to open it in the Explorer view.

Visualize a dataset with Pivot

Use Pivot to create a visualization based on your dataset. When you are satisfied with what you have created, you can save the visualization as a report or dashboard panel. You do not need to know how to use the Splunk Search Processing Language (SPL) to use it.

You can open all dataset types in Pivot.

Prerequisites

See Introduction to Pivot in the Splunk Enterprise Pivot Manual.

Steps

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Find a dataset that you want to work with in Pivot.
  3. Select Explore > Visualize with Pivot.

You can also access Pivot from the Explorer view. See Explore a dataset in Splunk Light in this manual.

Investigate a dataset in Search

You can investigate the contents of a dataset in the Search view. When you click Investigate in Search for a dataset, the Search view opens with a search string that uses the from command to reference that dataset. The results returned by this search provide a view into the contents of the dataset.

Apply additional SPL to the search string if you want, or leave it as is. At any time, you can save the search as a report, alert, or dashboard panel.

The saved search is considered to be extended from the original dataset. An extended dataset is distinct from, but dependent to, the parent dataset that it was extended from. If you change a parent dataset, that change propagates down to all datasets that you have extended from that parent dataset.

Prerequisites

Steps

  1. In the menu bar, click Datasets to open the Datasets listing page..
  2. Locate a dataset that you want to explore in Search.
  3. Select Explore > Investigate in Search.
    The search returns results in event list format by default. Switch the results format from List to Table to see the table view of the dataset.
  4. (Optional) Update the search string with additional SPL. Do not remove the from reference.
  5. (Optional) Click Save as to save your search, and select either Report, Dashboard Panel, or Alert.
  6. (Optional) Click New Table to create a new table dataset based on the search string.
    This option is only available if you use Splunk Cloud or Splunk Light, or if you use Splunk Enterprise and have installed the Splunk Datasets Add-on.

Edit datasets

From the Datasets listing page you can access the editing options for various dataset types.

Edit lookup table files

Prerequisites

See Use field lookups to add information to your events in the Splunk Enterprise Knowledge Manager Manual to learn about managing lookup table files.

Steps

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Locate a lookup table file that you want to edit.
  3. (Optional) Click the name of the lookup table file to view it in the dataset viewing page.
  4. Select Manage > Edit Lookup Table File. This opens a Settings page that lists the lookup table files that are uploaded to your Splunk platform implementation.
  5. (Optional) Update the permissions of the file.
  6. (Optional) Move lookup table files to a different app context.
  7. (Optional) Delete lookup table files.
  8. (Optional) Upload new .csv lookup table files.

Edit lookup definitions

The Datasets listing page lists all of the .csv lookup definitions and KV Store lookup definitions in your Splunk implementation.

Prerequisites

See Use field lookups to add information to your events in the Splunk Enterprise Knowledge Manager Manual to learn about editing lookup definitions.

Steps

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Locate a lookup definition that you want to edit.
  3. (Optional) Click the name of the lookup definition to view it in the dataset viewing page.
  4. Select Manage > Edit Lookup Definition. This opens the Settings page for the lookup definition.
  5. (Optional) Update the lookup definition. You can change the fields it matches, configure it to be time-based, and set up advanced field-matching rules.

Data model datasets

Go to the Data Model Editor to edit a data model dataset.

Prerequisites

See Design data models in Splunk Light in this manual.

Steps

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Locate a data model dataset that you want to edit.
  3. (Optional) Click the name data model dataset to view it in the dataset viewing page.
  4. Select Manage > Edit Data Model. This opens the data model dataset in the Data Model Editor.
  5. (Optional) Use the Data Model Editor to update the constraints and fields for the data model dataset.

Manage dataset permissions

Change dataset permissions to widen or restrict their availability to other users. You can set up read and write access by role, and you can determine whether datasets are globally accesible, restricted to a particular app context, or private to a single user.

For an overview of how the Splunk platform permissions features work, see Manage knowledge object permissions in the Splunk Enterprise Knowledge Manager Manual.

Lookups and table datasets

You can set permissions for lookups and table datasets directly through the Datasets listing page.

When you set permissions for a lookup table file, its permissions should be scoped in a way that makes it usable by any lookup definitions that you associate with it. For example, if a lookup table file has permissions that are scoped to a specific app, this is fine, as long as any lookup definitions that use that lookup table file also have permissions scoped to that app. If you want to associate that lookup table file with lookup definitions that are scoped to a different app, or that have global permissions, you will want to ensure the lookup table file has permissions scoped to "all apps." If you do not do this, the lookup may not work for some users.

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Locate a lookup or table dataset for which you need to view or update permissions.
  3. Select Manage > Edit Permissions.
  4. (Optional) Change the audience that you want the dataset to Display for.
    Option Definition
    Owner The lookup or table dataset is only available to the person who created it.
    App The lookup or table dataset has its permissions scoped to a single app. Users in other app contexts will be unable to see it or use it.
    All apps The lookup or table dataset has its permissions scoped to all apps. This means it has global availability to all users of your Splunk implementation.
  5. (Optional) If the dataset displays for an App or All apps, you can change the Read and Write settings that determine which roles can view or edit the dataset.
  6. Click Save to save your changes, or Cancel if you decide not to make any changes.

Data model datasets

Permissions for data model datasets are set at the data model level. All datasets within a data model have the same permissions settings. There are two ways to set permissions for data models:

  • Through the Data Model Editor
  • Through the Data Models listing page available from the sidebar menu

Prerequisites

Learn about setting data model permissions in About data model permissions in this manual.

Steps for setting data model dataset permissions with the Data Model Editor

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Identify the data model dataset for which you want to update permissions.
  3. Select Manage > Edit Data Model.
  4. Select Edit > Edit Permissions to set permissions for the data model that your selected data model dataset belongs to.
  5. (Optional) Change the audience that you want the data model to Display For. It can display for users of a specific App or users of All apps.
  6. (Optional) If the data model displays for an App or All apps, you can change the Read and Write settings that determine which roles can view or edit the data model.
  7. Click Save or Cancel.

Steps for setting data model dataset permissions with the Data Models listing page in the sidebar menu

  1. In the sidebar menu, select Data models.
  2. Identify the data model for which you would like to change permissions.
  3. Select Edit > Edit Permissions to set permissions for the data model that your selected data model dataset belongs to.
  4. (Optional) Change the audience that you want the data model to Display For. It can display for users of a specific App or users of All apps.
  5. (Optional) If the data model displays for an App or All apps, you can change the Read and Write settings that determine which roles can view or edit the data model.
  6. Click Save or Cancel.

Delete datasets

You can delete lookups and table datasets through the Datasets listing page. You can delete a data model dataset from the Data Model editor.

Lookups and table datasets

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Locate a lookup or table dataset that you want to delete.
  3. Select Manage > Delete.
  4. On the Delete Dataset dialog, click Delete again to verify that you want to delete the dataset.

You can also delete lookups and tables from their dataset viewing pages.

Data model datasets

  1. In the menu bar, click Datasets to open the Datasets listing page.
  2. Locate a data model dataset that you want to delete.
  3. Select Manage > Edit Dataset.
  4. In the Data Model Editor, click Delete for the data model dataset.
PREVIOUS
About datasets in Splunk Light
  NEXT
Explore a dataset in Splunk Light

This documentation applies to the following versions of Splunk® Light: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0, 7.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters