# Default dataspace

The **default dataspace** is where all standard observability data (**logs**, **spans**, and **custom enrichments**) is routed, unless configured otherwise.

By default, this is where most customers will see their data appear and query from.

## Querying the default dataspace

You can query from the default dataspace in two ways:

```dataprime
source default/logs
```

However, when no dataspace is explicitly provided, the default dataspace is assumed—no need to type it out unless you're feeling thorough.

This means users can simply write:

```dataprime
source logs
```

See [source](https://coralogix.com/docs/dataprime/language-reference/commands-reference/sources/source/index.md) documentation.

Both queries are equivalent, but the second is cleaner—especially useful when you’re working exclusively within the default dataspace, as many users are already used to.

## User-defined datasets

Beyond the predefined `logs` and `spans` datasets, you can create your own datasets under `default/` to isolate streams, prevent schema collisions, and apply dataset-level access control. See [User-defined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/index.md) for setup steps, TCO routing, the [streaming vs summary](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/#streaming-vs-summary-datasets) distinction, and access control.

## How it behaves with custom dataspaces

If your organization defines **custom dataspaces**, any data that does **not match routing rules** for those dataspaces is automatically sent to the default dataspace.

This ensures nothing is dropped, even if routing logic is incomplete or evolving.

## One user, one default

When querying a dataset name like `logs`, this user's query resolves to:

```dataprime
source <user-available-dataspace>/logs
```

**For this user** this is also the equivalent to:

```dataprime
source logs
```

This helps simplify onboarding and permissions for scoped users.

### Default context and dataspace resolution

If a user only has access to a single dataspace that dataspace becomes their **default context**. If a user only has access to a either `default` or `system`, that dataspace becomes their **default context**.

For example, if a user only has access to the `default` dataspace, a query like:

```dataprime
source logs
```

will resolve to:

```dataprime
source default/logs
```

Similarly, if a user is scoped only to the `frontend` dataspace, then:

```dataprime
source logs
```

is treated as:

```dataprime
source frontend/logs
```

This implicit resolution simplifies onboarding and access control, allowing scoped users to query naturally without having to specify the dataspace prefix every time.