Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Fdataprime.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Fdataprime.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# DataPrime query

**DataPrime** is the second query syntax in Explore, alongside **Builder**. Use it when you need the precision and flexibility of DataPrime's pipeline syntax for filtering, transforming, and aggregating log data at scale.

[![DataPrime mode](/docs/assets/images/dataprime-mode-e3773d2ba1f1fa87af4f1d5e487b1393.webp)](https://coralogix.com/docs/docs/assets/images/dataprime-mode-e3773d2ba1f1fa87af4f1d5e487b1393.webp) *DataPrime mode*

## Switch to DataPrime[​](#switch-to-dataprime "Direct link to Switch to DataPrime")

Switch to DataPrime from within Explore:

1. Open **Explore**.
2. In the query bar, toggle the syntax switch from **Builder** to **DataPrime**.

The search bar is replaced by the DataPrime query editor. The editor opens pre-populated with `source <dataset>` for the active dataset, or with a translated form of your current Lucene query. Your time range and dataset selection are preserved.

## Write a query[​](#write-a-query "Direct link to Write a query")

DataPrime uses a pipeline syntax: each step in the pipeline transforms or filters the data passed from the previous step. Start with a `source` statement, then chain operators with the `|` pipe character.

Example query — filter for errors and group by subsystem:

```
source logs

| filter $m.severity == ERROR

| groupby $l.subsystemname aggregate count() as error_count

| orderby $d.error_count desc

| limit 5
```

This query:

1. Sources data from the `logs` dataset.
2. Filters to log entries where severity is `ERROR` (a Coralogix metadata enum — no quotes).
3. Groups the filtered logs by subsystem and counts them.
4. Orders results by error count, highest first. Reference the alias `error_count` as `$d.error_count` — it lives in the user-data namespace after the aggregation.
5. Limits results to the top 5 subsystems.

Spans use the same pipeline syntax with `source spans`. For example, top 5 services by average span duration:

```
source spans

| groupby $l.serviceName aggregate avg($m.duration) as avg_duration

| orderby $d.avg_duration desc

| limit 5
```

Use `$d` for user-data fields, `$m` for Coralogix metadata (severity, applicationname, subsystemname, timestamp, duration), and `$l` for user labels and OpenTelemetry semantic-convention attributes (serviceName, operationName, and so on). See the [DataPrime documentation](https://coralogix.com/docs/docs/dataprime/introduction/welcome-to-the-dataprime-reference/.md) for the full namespace reference.

## DataPrime cheat sheet[​](#dataprime-cheat-sheet "Direct link to DataPrime cheat sheet")

Explore includes a built-in DataPrime reference so you can look up syntax without leaving the query editor. When DataPrime is the active syntax, select the help icon in the query bar to open the cheat sheet in a panel beside the results. The help icon appears only in DataPrime mode.

[![DataPrime cheat sheet](/docs/assets/images/dp-helper-02cb7464e2e8d0bbafbaf3683160e818.gif)](https://coralogix.com/docs/docs/assets/images/dp-helper-02cb7464e2e8d0bbafbaf3683160e818.gif)

Use the cheat sheet to:

* **Browse by section**: select a section from the outline dropdown to jump to it. The dropdown tracks the section you're reading as you scroll.
* **Search**: enter a term in the search box to highlight matches across the reference and move between them.
* **Copy an example**: hover over a code snippet and select the copy button, then paste the query into the editor.

Select the close button, or the help icon again, to hide the panel.

## Lucene to DataPrime[​](#lucene-to-dataprime "Direct link to Lucene to DataPrime")

Switching from **Builder** to **DataPrime** seeds the editor with a translated form of your Lucene query when one exists, otherwise with `source <dataset>` for the active dataset. The translation is structural, not semantic — review the result and adjust as needed.

DataPrime field references use a prefix notation: `$d` for log data fields, `$m` for metadata fields, and `$l` for user labels.

A confirmation dialog only appears when you leave a Builder-only context (Templates, Traces, Flows, or RED metrics). Its buttons are **Cancel**, **Open DataPrime in new tab**, and **Convert to DataPrime**. For a normal Logs tab in Lucene, the toggle switches without confirmation.

## Switch back to the query builder[​](#switch-back-to-the-query-builder "Direct link to Switch back to the query builder")

If you switch from DataPrime back to **Builder** without editing the DataPrime expression, Explore restores your original Builder filters, **Grouped by**, and **Aggregation** as they were before the switch — your Builder state remains intact.

If you edit the DataPrime expression and then switch back, Explore opens a **Please note** dialog with three options:

* **Cancel**: stay in DataPrime.
* **Open Lucene in new tab**: preserve the DataPrime query in the current tab and open a fresh tab in Builder.
* **Discard query**: return to Builder on the dataset's default empty state, discarding the DataPrime query.

[![Switch between queries](/docs/assets/images/dataprime-convert-1f1a764e77728dcfdc615ded34e2ac26.webp)](https://coralogix.com/docs/docs/assets/images/dataprime-convert-1f1a764e77728dcfdc615ded34e2ac26.webp)

The saved Builder state lives in the current tab only — refresh the page or open a new tab to clear it.

## Work with results[​](#work-with-results "Direct link to Work with results")

DataPrime results appear in a single **Results** tab below the query editor. The tab header shows the row count next to its name (for example, `Results 5`).

[![Results table](/docs/assets/images/resutls-table-2a23b9a5e6b5e297b3ac8ed13f879b66.webp)](https://coralogix.com/docs/docs/assets/images/resutls-table-2a23b9a5e6b5e297b3ac8ed13f879b66.webp)

On the **spans** dataset, the [Highlights](https://coralogix.com/docs/docs/user-guides/data_exploration/spans/highlights-tab/.md) tab is the one Builder-mode view preserved when you switch to DataPrime — running a DataPrime query while on the Highlights tab keeps you on Highlights instead of dropping you to Results. The other spans views (Spans, Traces, Flows, RED metrics) collapse into the single Results tab.

### Raw results[​](#raw-results "Direct link to Raw results")

Queries without a `groupby` operator return individual log records — one row per matching log. Each row is expandable in place; expand a row to inspect its fields. Use the column headers to sort by any column.

### Aggregated results[​](#aggregated-results "Direct link to Aggregated results")

Queries with a `groupby` operator return one row per group. Columns include each grouping field and the aliased aggregation outputs — for example, `subsystemname` and `error_count` from the example above.

## Chart visualizations[​](#chart-visualizations "Direct link to Chart visualizations")

On a time-based dataset, DataPrime renders a count-over-time chart above the Results table for non-aggregation queries — the same time-series chart Builder shows. The chart plots the record count across your selected time range.

[![DataPrime count-over-time chart above the results table, with the Visualize as selector in the results header](/docs/assets/images/dataprime-chart-39ddaae54fd4aa82bb9e0ffb65b14ca8.webp)](https://coralogix.com/docs/docs/assets/images/dataprime-chart-39ddaae54fd4aa82bb9e0ffb65b14ca8.webp)

Aggregation queries — those with a `groupby` or `aggregate` operator — return straight to the results table without the chart.

Use the **Visualize as** selector in the results header to change how results are displayed.

## Related resources[​](#related-resources "Direct link to Related resources")

* [DataPrime syntax reference](https://coralogix.com/docs/docs/dataprime/introduction/welcome-to-the-dataprime-reference/.md)
* [Query Builder](https://coralogix.com/docs/docs/user-guides/data_exploration/query_builder/.md)
* [Overview tab for logs](https://coralogix.com/docs/docs/user-guides/data_exploration/overview-tab/.md)

## Next steps[​](#next-steps "Direct link to Next steps")

Plot DataPrime results over time with the [time-series chart](https://coralogix.com/docs/docs/user-guides/data_exploration/timeseries-chart/.md).