The default Dataspace
The default dataspace is where all standard observability data (logs, spans, and custom enrichments) is routed, unless configured otherwise.
By default, this is where most customers will see their data appear and query from.
Querying the default dataspace
You can query from the default dataspace in two ways:
However, when no dataspace is explicitly provided, the default dataspace is assumed—no need to type it out unless you're feeling thorough.
This means users can simply write:
See source documentation.
Both queries are equivalent, but the second is cleaner—especially useful when you’re working exclusively within the default dataspace, as many users are already used to.
How it behaves with custom dataspaces
If your organization defines custom dataspaces, any data that does not match routing rules for those dataspaces is automatically sent to the default dataspace.
This ensures nothing is dropped, even if routing logic is incomplete or evolving.
One user, one default
When querying a dataset name like logs, this user's query resolves to:
For this user this is also the equivalent to:
This helps simplify onboarding and permissions for scoped users.
Default context and dataspace resolution
If a user only has access to a single dataspace that dataspace becomes their default context. If a user only has access to a either default or system, that dataspace becomes their default context.
For example, if a user only has access to the default dataspace, a query like:
will resolve to:
Similarly, if a user is scoped only to the frontend dataspace, then:
is treated as:
This implicit resolution simplifies onboarding and access control, allowing scoped users to query naturally without having to specify the dataspace prefix every time.