Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Fdatasets.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fdata_exploration%2Fdatasets.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Select a dataset

Every query in Explore starts with a dataset selection. Selecting the right dataset before running a query improves both the speed and relevance of your results.

[![Dataset selector showing available datasets](/docs/assets/images/data-source-selector-8688b3e902081b7ab352c29925a4a854.webp)](https://coralogix.com/docs/assets/images/data-source-selector-8688b3e902081b7ab352c29925a4a854.webp) *Dataset selector showing available datasets*

## Why your dataset selection matters[​](#why-your-dataset-selection-matters "Direct link to Why your dataset selection matters")

Use dataset selection for:

* **Faster queries**: Explore searches only within the selected dataset rather than across all your data, reducing query time and resource usage.
* **Focused results**: Results are scoped to the data type you are investigating, so logs queries return log events and spans queries return trace data, no noise from unrelated signal types.
* **Access to internal data**: System datasets expose Coralogix-managed metadata that is not part of your ingested data, such as alert history and audit events, without interfering with your application data.

## How the selector works[​](#how-the-selector-works "Direct link to How the selector works")

The dataset selector sits inside the query builder and shows every dataset available to your team in a searchable dropdown. Each row is rendered as `<dataspace>/<dataset>` (for example, `default/logs`) with an entity-type pill on the right.

At the bottom of the dropdown, two sets of checkboxes narrow the list, one by entity type (`logs`, `spans`, `jsonData`) and one by dataspace (`default`, `system`, `frequentsearch`). Only the entity types and dataspaces your team has appear.

When you switch to a different dataset, Explore:

* Resets the query to the empty state for the new dataset.
* Resets the column layout to the new entity type's defaults.
* Preserves the current time range.

## Dataspaces and datasets[​](#dataspaces-and-datasets "Direct link to Dataspaces and datasets")

Data in Coralogix is organized into [dataspaces](https://coralogix.com/docs/user-guides/data-layer/overview.md) and [datasets](https://coralogix.com/docs/user-guides/data-layer/overview.md).

* A dataspace is a logical container that groups related datasets and applies shared configuration.
* A dataset is the actual data store within a dataspace. The records you query.

For example, `logs` is a dataset inside the `default` dataspace. In DataPrime you reference it as `source default/logs` (or simply `source logs`). In Builder mode, you just pick it from the dataset selector, no `source` clause appears in the Lucene query you type.

| Dataset                                                                                                               | Dataspace        | Entity type |
| --------------------------------------------------------------------------------------------------------------------- | ---------------- | ----------- |
| `logs`                                                                                                                | `default`        | Logs        |
| `spans`                                                                                                               | `default`        | Spans       |
| `logs`, `spans`                                                                                                       | `frequentsearch` | Logs, Spans |
| `rum.events`                                                                                                          | `rum`            | Logs        |
| [User-defined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets.md) | `default`        | Logs        |
| [System datasets](https://coralogix.com/docs/user-guides/data-layer/system_dataspace.md)                              | `system`         | Various     |

## Predefined and custom datasets[​](#predefined-and-custom-datasets "Direct link to Predefined and custom datasets")

The datasets available in the selector fall into two groups, depending on who creates them:

* **Predefined datasets**: Datasets that Coralogix provides and manages. You don't create these. They exist based on the data you send and the features you enable. Predefined datasets include `logs` and `spans` in the `default` dataspace, their [Frequent Search](#frequent-search-dataspace) counterparts (`frequentsearch/logs` and `frequentsearch/spans`), the [system datasets](#system-datasets) that hold internal data such as alert history and audit events, and `rum.events` for Real User Monitoring data.
* **Custom datasets**: [User-defined datasets](#user-defined-datasets) that you create under the `default/` dataspace to isolate specific streams. You control the name, the routing policy that fills the dataset, and its access policy.

Note

`default` is the name of a dataspace, not a synonym for "predefined." The `default` dataspace holds both the predefined `logs` and `spans` datasets and any custom datasets you create, so a dataset under `default/` can be either kind.

## /logs[​](#logs "Direct link to /logs")

The `logs` dataset is the default selection in the `default` dataspace. It contains your ingested log data and is the starting point for most log investigations.

When you select `logs`, you can query with Lucene or DataPrime, apply filters, group results, and visualize log distributions.

## /spans[​](#spans "Direct link to /spans")

The `spans` dataset contains your distributed tracing data. Selecting `spans` lets you search traces, inspect spans, and drill into service dependencies.

## Frequent Search dataspace[​](#frequent-search-dataspace "Direct link to Frequent Search dataspace")

`frequentsearch` is a dataspace, like `default` and `system`, not a dataset. It contains the `logs` and `spans` datasets that hold the data you assign to the **High (Frequent Search)** [TCO Optimizer](https://coralogix.com/docs/user-guides/account-management/tco-optimizer.md) priority, indexed in hot storage (OpenSearch) for fast, interactive queries. You reference them as `frequentsearch/logs` and `frequentsearch/spans`. This is the fastest path for high-velocity, recent data. Select one from the dataset selector when you want quicker iteration over the most recent slice of your logs or spans. Query syntax, fields, and visualizations behave the same as `default/logs` and `default/spans`, with two differences:

* **Span Relation filters are not supported** on `frequentsearch` datasets. Explore clears them when you switch to or restore a `frequentsearch` dataset.
* **10-second auto-refresh is exclusive to Frequent Search.** The auto-refresh control in the time-range picker unlocks a 10-second interval only when a `frequentsearch` dataset is active.

## [User-defined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets.md)[​](#user-defined-datasets "Direct link to user-defined-datasets")

User-defined datasets are custom datasets you create under the `default/` dataspace to isolate specific log streams. After creating a dataset in **Dataset Management** and routing logs to it via a TCO policy, the dataset is available in the Explore dataset selector.

Select a user-defined dataset from the dataset selector. In DataPrime, Explore references it as `source default/<dataset-name>`. You can then search, filter, and aggregate the data with Lucene or DataPrime.

See [User-defined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets.md) for setup instructions.

### What Explore shows for a custom dataset[​](#what-explore-shows-for-a-custom-dataset "Direct link to What Explore shows for a custom dataset")

A custom dataset appears in the selector alongside the predefined ones, labeled by its fully-qualified name and entity-type pill (for example, `logs` or `jsonData`). Query it directly with Lucene or DataPrime and add **Group by** and **Aggregation** clauses as needed. Custom datasets don't come with pre-built queries. You build the query yourself.

The result panel shows the **Overview** and **Results** tabs, plus the [**Templates**](https://coralogix.com/docs/user-guides/data_exploration/logs/templates.md) view for `logs` datasets.

What else appears depends on the dataset's entity type:

* **Timestamped datasets** (for example, the `logs` entity type): the dataset behaves like `default/logs`. The time-range picker is active, a time-series chart appears above the results, the **Fields** panel groups fields into categories such as **Core** and **Kubernetes**, and results show **Timestamp**, **Content**, **Source**, **Application**, and **Subsystem** columns.
* **Non-timestamped (not partitioned) datasets** (for example, the `jsonData` entity type): the time-range picker is disabled, no chart appears, all fields fall under a single **Other** group, and each record renders in one **Source** column as JSON. See [Non-timestamped datasets](#non-timestamped-not-partitioned-datasets) for the full behavior.

To inspect a single record, select its row to open the [Log details panel](https://coralogix.com/docs/user-guides/data_exploration/logs/info_panel.md), where you can read the record as **Table**, **JSON**, or **Raw** and jump to related logs and resources.

## System datasets[​](#system-datasets "Direct link to System datasets")

System datasets are read-only datasets maintained by Coralogix. They contain internal observability data such as alert history, audit events, and limit violations.

| Dataset                                                                                                                           | Description                                                             |
| --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| [`system/aaa.audit_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/aaa_audit-events.md)               | Audit trail of system activity for compliance and access monitoring.    |
| [`system/alerts.history`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/alerts-history.md)                   | History of alert evaluations and trigger events.                        |
| [`system/engine.queries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine_queries.md)                   | Record of user queries for introspection and optimization.              |
| [`system/engine.schema_fields`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine-schema_fields.md)       | Field-level schema snapshots over time.                                 |
| [`system/labs.limit_violations`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/labs_limit-violations.md)     | Records of configured limit violations.                                 |
| [`system/notification.deliveries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/notification_deliveries.md) | Lifecycle of outbound alert notifications.                              |
| [`system/dataplan.quota_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/quota_events.md)              | Quota-related events: allocations, consumption, and threshold breaches. |
| [`system/dataplan.usage_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/dataplan-usage-events.md)     | Aggregated team data usage events.                                      |

System datasets must be enabled before they can be queried. Navigate to **Data Flow**, then **Dataset Management** to enable or disable them.

## Non-timestamped (not partitioned) datasets[​](#non-timestamped-not-partitioned-datasets "Direct link to Non-timestamped (not partitioned) datasets")

Some datasets (such as `jsonData` summary datasets) do not include a timestamp field, so they are not partitioned by time. See [Dataspaces and datasets](https://coralogix.com/docs/user-guides/data-layer/overview.md) for the dataset model and [Entity types](https://coralogix.com/docs/user-guides/data-layer/entity-types.md#schema-guarantees) for how time partitioning works.

When you select a non-timestamped dataset:

* The **time range picker is disabled** and shows the tooltip *The selected dataset is not partitioned by time*.
* Auto-refresh is force-cleared.
* No time-series chart appears above the results.
* The **Visualize as** selector is locked to **Table** until you add a Grouped by clause.

## Spans dataset views[​](#spans-dataset-views "Direct link to Spans dataset views")

The `spans` datasets (`default/spans` and `frequentsearch/spans`) carry distributed tracing data. Custom datasets currently support the `logs` pillar only, so there are no user-defined spans datasets. When you select a spans dataset, the result panel adds trace-focused views (such as **Traces**, **Flows**, and **Signals** (which includes RED metrics)) alongside the standard result views. The active view is captured in the URL, so saved views and shared links reopen the same view.

## Next steps[​](#next-steps "Direct link to Next steps")

Review the role-based and policy-based permissions required to use Explore in [Explore permissions](https://coralogix.com/docs/user-guides/data_exploration/permissions.md).