Open in ChatGPTOpen in Claude

Select a dataset

Every query in Explore starts with a dataset selection. Selecting the right dataset before running a query improves both the speed and relevance of your results.

Dataset selector showing available datasets

Why your dataset selection matters

Use dataset selection for:

• Faster queries: Explore searches only within the selected dataset rather than across all your data, reducing query time and resource usage.
• Focused results: Results are scoped to the data type you are investigating, so logs queries return log events and spans queries return trace data — no noise from unrelated signal types.
• Access to internal data: System datasets expose Coralogix-managed metadata that is not part of your ingested data, such as alert history and audit events, without interfering with your application data.

How the selector works

The dataset selector sits inside the query builder and shows every dataset available to your team in a searchable dropdown. Each row is rendered as <dataspace>/<dataset> (for example, default/logs) with an entity-type pill on the right.

At the bottom of the dropdown, two sets of checkboxes narrow the list — one by entity type (logs, spans, jsonData) and one by dataspace (default, system, frequentsearch). Only the entity types and dataspaces your team has appear.

When you switch to a different dataset, Explore:

• Resets the query to the empty state for the new dataset.
• Resets the column layout to the new entity type's defaults.
• Preserves the current time range.

Dataspaces and datasets

Data in Coralogix is organized into dataspaces and datasets.

• A dataspace is a logical container that groups related datasets and applies shared configuration.
• A dataset is the actual data store within a dataspace — the records you query.

For example, logs is a dataset inside the default dataspace. In DataPrime you reference it as source default/logs (or simply source logs). In Builder mode, you just pick it from the dataset selector — no source clause appears in the Lucene query you type.

Dataset	Dataspace	Entity type
logs	default	Logs
spans	default	Spans
logs, spans	frequentsearch	Logs, Spans
rum.events	rum	Logs
User-defined datasets	default	Logs
System datasets	system	Various

Predefined and custom datasets

The datasets available in the selector fall into two groups, depending on who creates them:

• Predefined datasets: Datasets that Coralogix provides and manages. You don't create these — they exist based on the data you send and the features you enable. Predefined datasets include logs and spans in the default dataspace, their Frequent Search counterparts (frequentsearch/logs and frequentsearch/spans), the system datasets that hold internal data such as alert history and audit events, and rum.events for Real User Monitoring data.
• Custom datasets: User-defined datasets that you create under the default/ dataspace to isolate specific streams. You control the name, the routing policy that fills the dataset, and its access policy.

Note

default is the name of a dataspace, not a synonym for "predefined." The default dataspace holds both the predefined logs and spans datasets and any custom datasets you create, so a dataset under default/ can be either kind.

/logs

The logs dataset is the default selection in the default dataspace. It contains your ingested log data and is the starting point for most log investigations.

When you select logs, you can query with Lucene or DataPrime, apply filters, group results, and visualize log distributions.

/spans

The spans dataset contains your distributed tracing data. Selecting spans lets you search traces, inspect spans, and drill into service dependencies.

Frequent Search dataspace

frequentsearch is a dataspace, like default and system — not a dataset. It contains the logs and spans datasets that hold the data you assign to the High (Frequent Search) TCO Optimizer priority — indexed in hot storage (OpenSearch) for fast, interactive queries. You reference them as frequentsearch/logs and frequentsearch/spans. This is the fastest path for high-velocity, recent data. Select one from the dataset selector when you want quicker iteration over the most recent slice of your logs or spans. Query syntax, fields, and visualizations behave the same as default/logs and default/spans, with two differences:

• Span Relation filters are not supported on frequentsearch datasets. Explore clears them when you switch to or restore a frequentsearch dataset.
• 10-second auto-refresh is exclusive to Frequent Search. The auto-refresh control in the time-range picker unlocks a 10-second interval only when a frequentsearch dataset is active.

User-defined datasets

User-defined datasets are custom datasets you create under the default/ dataspace to isolate specific log streams. After creating a dataset in Dataset Management and routing logs to it via a TCO policy, the dataset is available in the Explore dataset selector.

Select a user-defined dataset from the dataset selector. In DataPrime, Explore references it as source default/<dataset-name>. You can then search, filter, and aggregate the data with Lucene or DataPrime.

See User-defined datasets for setup instructions.

What Explore shows for a custom dataset

A custom dataset appears in the selector alongside the predefined ones, labeled by its fully-qualified name and entity-type pill (for example, logs or jsonData). Query it directly with Lucene or DataPrime and add Group by and Aggregation clauses as needed. Custom datasets don't come with pre-built queries — you build the query yourself.

The result panel shows the Overview and Results tabs, plus the Templates view for logs datasets.

What else appears depends on the dataset's entity type:

• Timestamped datasets (for example, the logs entity type): the dataset behaves like default/logs. The time-range picker is active, a time-series chart appears above the results, the Fields panel groups fields into categories such as Core and Kubernetes, and results show Timestamp, Content, Source, Application, and Subsystem columns.
• Non-timestamped (not partitioned) datasets (for example, the jsonData entity type): the time-range picker is disabled, no chart appears, all fields fall under a single Other group, and each record renders in one Source column as JSON. See Non-timestamped datasets for the full behavior.

To inspect a single record, select its row to open the Log details panel, where you can read the record as Table, JSON, or Raw and jump to related logs and resources.

System datasets

System datasets are read-only datasets maintained by Coralogix. They contain internal observability data such as alert history, audit events, and limit violations.

Dataset	Description
system/aaa.audit_events	Audit trail of system activity for compliance and access monitoring.
system/alerts.history	History of alert evaluations and trigger events.
system/engine.queries	Record of user queries for introspection and optimization.
system/engine.schema_fields	Field-level schema snapshots over time.
system/labs.limit_violations	Records of configured limit violations.
system/notification.deliveries	Lifecycle of outbound alert notifications.
system/dataplan.quota_events	Quota-related events: allocations, consumption, and threshold breaches.
system/dataplan.usage_events	Aggregated team data usage events.

System datasets must be enabled before they can be queried. Navigate to Data Flow, then Dataset Management to enable or disable them.

Non-timestamped (not partitioned) datasets

Some datasets — such as jsonData summary datasets — do not include a timestamp field, so they are not partitioned by time. See Dataspaces and datasets for the dataset model and Entity types for how time partitioning works.

When you select a non-timestamped dataset:

• The time range picker is disabled and shows the tooltip The selected dataset is not partitioned by time.
• Auto-refresh is force-cleared.
• No time-series chart appears above the results.
• The Visualize as selector is locked to Table until you add a Grouped by clause.

Spans dataset views

The spans datasets — default/spans and frequentsearch/spans — carry distributed tracing data. Custom datasets currently support the logs pillar only, so there are no user-defined spans datasets. When you select a spans dataset, the result panel adds trace-focused views — such as Traces, Flows, and Signals (which includes RED metrics) — alongside the standard result views. The active view is captured in the URL, so saved views and shared links reopen the same view.

Next steps

Review the role-based and policy-based permissions required to use Explore in Explore permissions.