Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-dataspace.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata-layer%2Fdefault-dataspace.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Default dataspace

The **default dataspace** is where all standard observability data (**logs**, **spans**, and **custom enrichments**) is routed, unless configured otherwise.

By default, this is where most customers will see their data appear and query from.

## Querying the default dataspace[​](#querying-the-default-dataspace "Direct link to Querying the default dataspace")

You can query from the default dataspace in two ways:

```
source default/logs
```

However, when no dataspace is explicitly provided, the default dataspace is assumed—no need to type it out unless you're feeling thorough.

This means users can simply write:

```
source logs
```

See [source](https://coralogix.com/docs/docs/dataprime/language-reference/commands-reference/sources/source/.md) documentation.

Both queries are equivalent, but the second is cleaner—especially useful when you’re working exclusively within the default dataspace, as many users are already used to.

## User-defined datasets[​](#user-defined-datasets "Direct link to User-defined datasets")

Beyond the predefined `logs` and `spans` datasets, you can create your own datasets under `default/` to isolate streams, prevent schema collisions, and apply dataset-level access control. See [User-defined datasets](https://coralogix.com/docs/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/.md) for setup steps, TCO routing, the [streaming vs summary](https://coralogix.com/docs/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/.md#streaming-vs-summary-datasets) distinction, and access control.

## How it behaves with custom dataspaces[​](#how-it-behaves-with-custom-dataspaces "Direct link to How it behaves with custom dataspaces")

If your organization defines **custom dataspaces**, any data that does **not match routing rules** for those dataspaces is automatically sent to the default dataspace.

This ensures nothing is dropped, even if routing logic is incomplete or evolving.

## One user, one default[​](#one-user-one-default "Direct link to One user, one default")

When querying a dataset name like `logs`, this user's query resolves to:

```
source <user-available-dataspace>/logs
```

**For this user** this is also the equivalent to:

```
source logs
```

This helps simplify onboarding and permissions for scoped users.

### Default context and dataspace resolution[​](#default-context-and-dataspace-resolution "Direct link to Default context and dataspace resolution")

If a user only has access to a single dataspace that dataspace becomes their **default context**. If a user only has access to a either `default` or `system`, that dataspace becomes their **default context**.

For example, if a user only has access to the `default` dataspace, a query like:

```
source logs
```

will resolve to:

```
source default/logs
```

Similarly, if a user is scoped only to the `frontend` dataspace, then:

```
source logs
```

is treated as:

```
source frontend/logs
```

This implicit resolution simplifies onboarding and access control, allowing scoped users to query naturally without having to specify the dataspace prefix every time.