Find relevant datasets

Filter and sort datasets in the Catalog in Splunk Cloud Platform to find the ones that are relevant to your investigation.

Use the filtering and sorting options on the Datasets tab of the Catalog to find datasets that relate to your investigation.

Note: For recently promoted datasets that contain a large volume of data, there might be a delay before those datasets can be filtered by default event fields. For example, a 1 TB promoted dataset might be excluded from filtering until approximately 15 minutes after the completion of the promotion job.
Filter by dataset information:
  1. Enter 1 or more keywords in the Filters field and then select Apply. Separate each keyword with a space.

    The Catalog returns a dataset if your keywords partially or fully match any of the following:

    • The information on the page, such as the dataset name or type

    • The general information in the dataset side panel, such as the dataset description or kind

    For example, filtering for aws can return datasets named aws_logs or rawstrings, as well as datasets where the kind is aws_s3 or the description is Cold storage in AWS S3 for INFO logs.

  2. Select the Name, Type, or Created by column header, and then specify a filter.
    The Catalog returns a dataset if your filter partially or fully matches the value in that column.
Filter raw tables and promoted datasets by default event fields:
  1. In the Filters field, enter 1 or more field-value pairs that use the source, sourcetype, or host event fields. Then, select Apply. Separate each field-value pair with a space.

    The Catalog returns a raw table, analytics table, or promoted Splunk index if it contains any events that have the specified field-value pair. For example, filtering for sourcetype=WinEventLog returns raw tables and promoted datasets that contain events where the value of the sourcetype field is WinEventLog.

    You can use asterisks ( * ) as wildcard characters to allow partial matches. For example, filtering for sourcetype=*WinEventLog returns raw tables and promoted datasets that contain events where the value of the sourcetype field is either WinEventLog or XmlWinEventLog.

    You can specify field-value pairs and keywords in the same filter. For example, the following filter returns raw tables and promoted datasets that match both of the keywords apache and syslog, and also contain events where the value of the sourcetype field is cisco:asa and the value of the host field starts with my_server_:
    CODE 
    apache syslog sourcetype=cisco:asa host=my_server_*
  2. Set the Filter by time range option to a specific time range.

    For example, you can filter for raw tables and promoted datasets that contain logs that were generated today, or filter for raw tables and promoted datasets containing logs that were generated between June 15, 2026 and June 19, 2026.

Sort the list of datasets:
  1. Select any of the column headers to sort the datasets by ascending or descending order.

    For example, you can view older datasets first by selecting the Created column header so that the down arrow icon (Image of an arrow pointing down) changes to an up arrow icon (Image of an arrow pointing up), indicating that the datasets are being sorted in ascending order based on the date and time when they were created.