Explore a dataset in Splunk Light

The Explorer view lets you look at the contents of any dataset on the Datasets listing page. It gives you an easy way to inspect the contents of any dataset listed on the page, including data model datasets and lookups.

The Explorer view provides a variety of dataset exploration and management capabilities:

• Use two views for dataset exploration:
  • Preview Rows, which renders the dataset in a standard table format.
  • Summarize Fields, which displays statistical information for each of the fields in your table and their values.
• Set the dataset time range.
• Manage the dataset search job.
• Export the contents of the dataset for a given time range.
• Extend your dataset as a scheduled report.

You can also perform the same dataset management actions that you have access to through the Datasets listings page. See View and manage datasets in Splunk Light and View and manage table datasets in Splunk Light in this manual.

Open the Explorer view for a dataset

Use the Datasets listing page to access the Explorer view for a selected dataset.

1. In the menu bar, click Datasets to open the Datasets listing page.
2. Find a dataset you want to explore.
3. Click the dataset name to open it in the Explorer view.

Ways to view datasets

The Explorer view gives you two ways to view your dataset. You can Preview Rows or you can Summarize Fields.

Preview Rows

Preview Rows is the default for the Explorer view. It displays your table dataset as a table, with fields as columns, values in cells, and sample events in rows.

Summarize Fields

Click Summarize Fields to see analytical details about the fields in the table. You can see top value distributions, null value percentages, numeric value statistics, and more.

Set the dataset time range

The time range picker enables you to restrict the data your dataset view contains to events that fall within specific ranges of time. It applies to search-based dataset types like data model datasets and table datasets.

Lookup table files and lookup definitions usually get their data from static CSV files and KV store collections, so the time range picker does not apply to them. They display the same rows of data no matter what time range you select.

The time range picker is set to Last 24 hours by default. If your dataset has no results from the last 24 hours, this view will appear to be empty when you first enter it. To fix this, adjust the time range picker to a range where events are present.

The time range picker gives you a variety of time range definition options. You can choose a pre-set time range, or you can define a custom time range. For help with the time range picker, see Select time ranges to apply to your search in the Splunk Enterprise Search Manual.

Manage the dataset search job

When you enter the Explorer view, a search job runs over the time range set by the time range picker. Its results populate the dataset view.

After you launch a dataset search, a set of controls to the top right of the dataset view let you manage the search job in different ways without leaving the Explorer view. In the middle of this control set you can find pause/start and stop icons that you can use while the dataset search is in progress.

Use the Job menu actions

The Job menu helps you access the dataset search job and access information about it.

1. After your search is running, paused, or finalized, click Job.
   
2. Choose from the list options.
   

   Action	Description
   Edit Job Settings...	Opens the Job Settings dialog, where you can change the read permissions for the job, extend the job lifespan, and get a URL for the job. You can use the URL to share the job with others or to add a bookmark to the job in your Web browser.
   Send Job to Background	Runs the job on the background. Use this option if the search job is slow to complete. This enables you to work on other activities, including running a new search job.
   Inspect Job	Opens the Search Job Inspector window and displays information and metrics about the search job. You can select this action while the search is running or after the search completes. For more information, see View search job properties in the Splunk Enterprise Search Manual.

For more information, see About jobs and job management in the Splunk Enterprise Search Manual.

Share a job

Click the Share icon to share the job. When you select this, the job's lifetime is extended to 7 days and read permissions are set to Everyone. For more information about jobs, see About jobs and job management in the Splunk Enterprise Search Manual.

Export the job results

Click the Export icon to export the results of a dataset search job. You can select to output to CSV, XML, or JSON and specify the number of results to export.

If this export method does not meet your needs, see Export search results in the Splunk Enterprise Search Manual.

Extend the dataset as a scheduled report

You can extend your dataset as a new scheduled report. The report uses a from in its base search to reference the dataset that you are viewing. This means that the report has a child/parent relationship with the dataset. Changes you make to the dataset in the future are passed down to the report. Changes you make to the report are not passed up to the dataset.

Select Manage > Schedule Report to extend the dataset as a scheduled report. This opens the Schedule Report dialog where you can create the report schedule and define actions that are triggered each time the report runs. For example, you can arrange to have the Splunk software add the report results to a specific CSV file each time the report runs. You can also define scheduled report actions that send the results to a set of people in email format or that run scripts.

For more information about using this dialog to create the report schedule and define actions for it, see Schedule reports in the Splunk Enterprise Reporting Manual.

Manage your dataset

The Explorer view gives you the same dataset management capabilities as the Dataset listing page. If you review the contents of a dataset and decide you want to work with it, you do not need to return to the Dataset listing page. You can apply management actions to it from this view.

The Explorer view includes management actions for all dataset types:

• Visualize a dataset with Pivot
• Investigate a dataset with Search
• Edit a dataset
• Update dataset permissions
• Delete a dataset
• Extend a dataset as a new table dataset
• Clone a table dataset
• Edit table dataset descriptions
• Accelerate table datasets

See View and manage datasets in Splunk Light and View and manage table datasets in Splunk Light in this manual for details on these tasks.