Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Fdatasets.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Fdatasets.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Select a dataset

Every query in Explore starts with a dataset selection. Selecting the right dataset before running a query improves both the speed and relevance of your results.

[![Dataset selector showing available datasets](/docs/assets/images/data-source-selector-8688b3e902081b7ab352c29925a4a854.webp)](https://coralogix.com/docs/docs/assets/images/data-source-selector-8688b3e902081b7ab352c29925a4a854.webp) *Dataset selector showing available datasets*

## Why your dataset selection matters[​](#why-your-dataset-selection-matters "Direct link to Why your dataset selection matters")

Use dataset selection for:

* **Faster queries**: Explore searches only within the selected dataset rather than across all your data, reducing query time and resource usage.
* **Focused results**: Results are scoped to the data type you are investigating, so logs queries return log events and spans queries return trace data — no noise from unrelated signal types.
* **Access to internal data**: System datasets expose Coralogix-managed metadata that is not part of your ingested data, such as alert history and audit events, without interfering with your application data.

## How the selector works[​](#how-the-selector-works "Direct link to How the selector works")

The dataset selector sits inside the query builder and shows every dataset available to your team in a searchable dropdown. Each row is rendered as `<dataspace> / <dataset>` (for example, **Default / logs**) with an entity-type pill on the right.

At the bottom of the dropdown, three checkboxes — **Logs**, **Spans**, and **Other** — narrow the list to the entity types you care about.

When you switch to a different dataset, Explore:

* Resets the query to the empty state for the new dataset.
* Resets the column layout to the new entity type's defaults.
* Preserves the current time range.

## Dataspaces and datasets[​](#dataspaces-and-datasets "Direct link to Dataspaces and datasets")

Data in Coralogix is organized into [dataspaces](https://coralogix.com/docs/docs/user-guides/data-layer/overview/.md) and [datasets](https://coralogix.com/docs/docs/user-guides/data-layer/overview/.md).

* A dataspace is a logical container that groups related datasets and applies shared configuration.
* A dataset is the actual data store within a dataspace — the records you query.

For example, `logs` is a dataset inside the `default` dataspace. In DataPrime you reference it as `source default/logs` (or simply `source logs`). In Builder mode, you just pick it from the dataset selector — no `source` clause appears in the Lucene query you type.

| Dataset                                                                                                                     | Dataspace | Entity type                                      |
| --------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------ |
| `logs`                                                                                                                      | `default` | Logs                                             |
| `spans`                                                                                                                     | `default` | Spans                                            |
| [User-defined datasets](https://coralogix.com/docs/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/.md) | `default` | Any dataset you create under `default/`          |
| System datasets                                                                                                             | `system`  | `alerts.history`, `aaa.audit_events`, and others |
| `rum.events`                                                                                                                | RUM       | RUM events ingested from the browser SDK         |

## /logs[​](#logs "Direct link to /logs")

The `logs` dataset is the default selection in the `default` dataspace. It contains your ingested log data and is the starting point for most log investigations.

When you select `logs`, you can query with Lucene or DataPrime, apply filters, group results, and visualize log distributions.

## /spans[​](#spans "Direct link to /spans")

The `spans` dataset contains your distributed tracing data. Selecting `spans` lets you search traces, inspect spans, and drill into service dependencies.

## Frequent Search datasets[​](#frequent-search-datasets "Direct link to Frequent Search datasets")

The `frequentsearch/logs` and `frequentsearch/spans` datasets query Coralogix's Frequent Search index — a faster path for high-velocity, recent data. Select these from the dataset selector when you want quicker iteration over the most recent slice of your logs or spans. Query syntax, fields, and visualizations behave the same as `logs` and `spans`, with two differences:

* **Span Relation filters are not supported** on Frequent Search datasets. Explore clears them when you switch to or restore a Frequent Search dataset.
* **10-second auto-refresh is exclusive to Frequent Search.** The auto-refresh control in the time-range picker unlocks a 10-second interval only when a Frequent Search dataset is active.

## [User-defined datasets](https://coralogix.com/docs/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/.md)[​](#user-defined-datasets "Direct link to user-defined-datasets")

User-defined datasets are custom datasets you create under the `default/` dataspace to isolate specific log streams. After creating a dataset in **Dataset Management** and routing logs to it via a TCO policy, the dataset is available in the Explore dataset selector.

Select a user-defined dataset from the dataset selector. In DataPrime, Explore references it as `source default/<dataset-name>`. You can then search, filter, and visualize the data as you would with `logs` or `spans`.

See [User-defined datasets](https://coralogix.com/docs/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/.md) for setup instructions.

## System datasets[​](#system-datasets "Direct link to System datasets")

System datasets are read-only datasets maintained by Coralogix. They contain internal observability data such as alert history, audit events, and limit violations.

| Dataset                                                                                                                                 | Description                                                             |
| --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| [`system/aaa.audit_events`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/aaa_audit-events/.md)               | Audit trail of system activity for compliance and access monitoring.    |
| [`system/alerts.history`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/alerts-history/.md)                   | History of alert evaluations and trigger events.                        |
| [`system/engine.queries`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/engine_queries/.md)                   | Record of user queries for introspection and optimization.              |
| [`system/engine.schema_fields`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/engine-schema_fields/.md)       | Field-level schema snapshots over time.                                 |
| [`system/labs.limit_violations`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/labs_limit-violations/.md)     | Records of configured limit violations.                                 |
| [`system/notification.deliveries`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/notification_deliveries/.md) | Lifecycle of outbound alert notifications.                              |
| [`system/dataplan.quota_events`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/quota_events/.md)              | Quota-related events: allocations, consumption, and threshold breaches. |
| [`system/dataplan.usage_events`](https://coralogix.com/docs/docs/user-guides/data-layer/system_dataspace/dataplan-usage-events/.md)     | Aggregated team data usage events.                                      |

System datasets must be enabled before they can be queried. Navigate to **Data Flow**, then **Dataset Management** to enable or disable them.

## Non-timestamped datasets[​](#non-timestamped-datasets "Direct link to Non-timestamped datasets")

Some datasets do not include a timestamp field. Explore supports querying these datasets with pre-built queries and pre-configured graphs, so analysis is accessible without building queries from scratch.

When you select a non-timestamped dataset:

* The **time range picker is disabled** and shows the tooltip *The selected dataset is not partitioned by time*.
* Auto-refresh is force-cleared.
* The **Visualize as** selector is locked to **Table** until you add a Grouped by clause.

Use the pre-built queries and graphs as a starting point.

## Spans sub-view[​](#spans-sub-view "Direct link to Spans sub-view")

When the selected dataset has the **Spans** entity type, the result panel exposes additional view modes — **Spans**, **Traces**, **Flows**, **Analyze**, **RED metrics** — alongside the standard tabs. The current sub-view is captured in the URL so saved views and shared links restore the same sub-view.

## Next steps[​](#next-steps "Direct link to Next steps")

Review the role-based and policy-based permissions required to use Explore in [Explore permissions](https://coralogix.com/docs/docs/user-guides/data_exploration/permissions/.md).