# Select a data source

Every query in Explore starts with a data source selection. Selecting the right data source before running a query improves both the speed and relevance of your results.

*Data source selector showing available datasets*

## Why your data source selection matters

Use data source selection for:

- **Faster queries** — Explore searches only within the selected dataset rather than across all your data, reducing query time and resource usage.
- **Focused results** — Results are scoped to the data type you are investigating, so logs queries return log events and spans queries return trace data — no noise from unrelated signal types.
- **Access to internal data** — System datasets expose Coralogix-managed metadata that is not part of your ingested data, such as alert history and audit events, without interfering with your application data.

## Dataspaces and datasets

Data in Coralogix is organized into [dataspaces](https://coralogix.com/docs/user-guides/data-layer/dataspaces/index.md) and [datasets](https://coralogix.com/docs/user-guides/data-layer/datasets/index.md).

- A dataspace is a logical container that groups related datasets and applies shared configuration.
- A dataset is the actual data store within a dataspace — the records you query.

For example, `logs` is a dataset inside the `default` dataspace. In DataPrime, you reference it as `source default/logs`, or simply as `source logs` in Explore.

| Data source                                                                                                                 | Dataspace | Dataset                                          |
| --------------------------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------ |
| `logs`                                                                                                                      | `default` | `logs`                                           |
| `spans`                                                                                                                     | `default` | `spans`                                          |
| [User-defined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/index.md) | `default` | Any dataset you create under `default/`          |
| System datasets                                                                                                             | `system`  | `alerts.history`, `aaa.audit_events`, and others |

## /logs

The `logs` data source is the default dataset in the `default` dataspace. It contains your ingested log data and is the starting point for most log investigations.

When you select `logs`, you can query with Lucene or DataPrime, apply filters, group results, and visualize log distributions.

## /spans

The `spans` data source contains your distributed tracing data. Selecting `spans` allows you to search traces, inspect spans, and drill into service dependencies.

## [User-defined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/index.md)

User-defined datasets are custom datasets you create under the `default/` dataspace to isolate specific log streams. After creating a dataset in **Dataset Management** and routing logs to it via a TCO policy, the dataset is available as a data source in Explore.

Select a user-defined dataset from the data source selector. Explore opens it with `source default/<dataset-name>`. You can then search, filter, and visualize the data as you would with `logs` or `spans`.

See [User-defined datasets](https://coralogix.com/docs/user-guides/data-layer/default-dataspace/user-defined-datasets/index.md) for setup instructions.

## System datasets

System datasets are read-only datasets maintained by Coralogix. They contain internal observability data such as alert history, audit events, and limit violations.

| Dataset                                                                                                                                 | Description                                                          |
| --------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
| [`system/aaa.audit_events`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/aaa_audit-events/index.md)               | Audit trail of system activity for compliance and access monitoring. |
| [`system/alerts.history`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/alerts-history/index.md)                   | History of alert evaluations and trigger events.                     |
| [`system/engine.queries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine_queries/index.md)                   | Record of user queries for introspection and optimization.           |
| [`system/engine.schema_fields`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/engine-schema_fields/index.md)       | Field-level schema snapshots over time.                              |
| [`system/labs.limit_violations`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/labs_limit-violations/index.md)     | Records of configured limit violations.                              |
| [`system/notification.deliveries`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/notification_deliveries/index.md) | Lifecycle of outbound alert notifications.                           |
| [`system/notification.requests`](https://coralogix.com/docs/user-guides/data-layer/system_dataspace/notification_requests/index.md)     | Incoming notification request metadata.                              |

System datasets must be enabled before they can be queried. Navigate to **Data Flow**, then **Dataset Management** to enable or disable them.

## Non-timestamped datasets

Some datasets do not include a timestamp field. Explore supports querying these datasets with pre-built queries and pre-configured graphs, so analysis is accessible without building queries from scratch.

When you select a non-timestamped dataset, the time range picker does not filter results — all records in the dataset are included. Use the pre-built queries and graphs as a starting point.

## Next steps

Learn how to find the logs and spans you need in [Search logs and spans](https://coralogix.com/docs/user-guides/data_exploration/search/index.md).