Select a data source

Every query in Explore starts with a data source selection. Selecting the right data source before running a query improves both the speed and relevance of your results.

Data source selector showing available datasets

Why your data source selection matters

Use data source selection for:

• Faster queries — Explore searches only within the selected dataset rather than across all your data, reducing query time and resource usage.
• Focused results — Results are scoped to the data type you are investigating, so logs queries return log events and spans queries return trace data — no noise from unrelated signal types.
• Access to internal data — System datasets expose Coralogix-managed metadata that is not part of your ingested data, such as alert history and audit events, without interfering with your application data.

Dataspaces and datasets

Data in Coralogix is organized into dataspaces and datasets.

• A dataspace is a logical container that groups related datasets and applies shared configuration.
• A dataset is the actual data store within a dataspace — the records you query.

For example, logs is a dataset inside the default dataspace. In DataPrime, you reference it as source default/logs, or simply as source logs in Explore.

Data source	Dataspace	Dataset
logs	default	logs
spans	default	spans
System datasets	system	alerts.history, aaa.audit_events, and others

/logs

The logs data source is the default dataset in the default dataspace. It contains your ingested log data and is the starting point for most log investigations.

When you select logs, you can query with Lucene or DataPrime, apply filters, group results, and visualize log distributions.

/spans

The spans data source contains your distributed tracing data. Selecting spans allows you to search traces, inspect spans, and drill into service dependencies.

System datasets

System datasets are read-only datasets maintained by Coralogix. They contain internal observability data such as alert history, audit events, and limit violations.

Dataset	Description
system/aaa.audit_events	Audit trail of system activity for compliance and access monitoring.
system/alerts.history	History of alert evaluations and trigger events.
system/engine.queries	Record of user queries for introspection and optimization.
system/engine.schema_fields	Field-level schema snapshots over time.
system/labs.limit_violations	Records of configured limit violations.
system/notification.deliveries	Lifecycle of outbound alert notifications.
system/notification.requests	Incoming notification request metadata.

System datasets must be enabled before they can be queried. Navigate to Data Flow, then Dataset Management to enable or disable them.

Non-timestamped datasets

Some datasets do not include a timestamp field. Explore supports querying these datasets with pre-built queries and pre-configured graphs, so analysis is accessible without building queries from scratch.

When you select a non-timestamped dataset, the time range picker does not filter results — all records in the dataset are included. Use the pre-built queries and graphs as a starting point.