Manage table datasets

You can create and manage table datasets using the Datasets listing page for the Splunk platform.

For information about default features of the Datasets listing page, such as accessing Explorer views of datasets, investigating datasets in Search, and visualizing datasets with Pivot, see Manage datasets.

Create table datasets

To create a table dataset, click Datasets in the green Apps bar, and then click Create Table View. This takes you to the Table Views workflow. After you define initial data, you can also edit the dataset with Table Views.

To learn more about creating a new table dataset, see Define initial data for a new table dataset and View and update a table dataset.

CAUTION: When you create table datasets, always give them unique names. If you have more than one table dataset with the same name in your system you risk experiencing object name collision issues that are difficult to resolve.
For example, say you have two table datasets named Store Sales, and you share one at the global level, but leave the other one private. If you then extend the global Store Sales dataset, the dataset that is created through that extension will display the table from the private Store Sales dataset instead.

Delete a table dataset

You can delete any table dataset that you have write permissions for.

CAUTION: Before deleting a table dataset, verify that it is not extended to one or more child table datasets. Deleting a parent dataset breaks tables and other objects that are extended from it. For example, if table Alpha is extended to table Beta, and table Beta is in turn used to create a Pivot visualization that is used in a dashboard panel, that dashboard panel ceases to function if you delete table Alpha.
  1. On the Datasets listing page, find the table dataset that you want to delete.
  2. Select Edit > Delete.
  3. Click Delete again to confirm.

Extend a dataset as a new table dataset

You can extend any dataset as a new table dataset. The extended dataset is a new dataset that is bound to the original dataset through its reference to that dataset. If the definition of the parent dataset changes, those changes are passed down to any child datasets that are extended from it.

To see from what datasets a table dataset is extended, expand its row in the Datasets listing page by clicking its > symbol in the first column. The parent datasets for that dataset are listed in an Extends line item. If a table dataset does not have an Extends line item, it is not extended from another dataset.

Prerequisites

Steps

  1. On the Datasets listing page, find a dataset that you want to extend.
  2. For that dataset, select Edit > Extend in Table.
  3. (Optional) Use Table Views to modify the new table.
  4. Click Save to open the Save As New Table dialog.
  5. Enter a Table Title.
  6. Click Save to save the table.

Clone a table dataset

Clone a table dataset to make a new table dataset that is a copy of an existing dataset. Cloning differs from dataset extension in that you can make changes to the original dataset without affecting datasets that are cloned from that dataset.

Note: Table datasets are the only dataset type that can be cloned through the Datasets listing page. You can clone lookup definition datasets through the Lookup Definitions page in Settings.
  1. On the Datasets listing page, find a table dataset that you want to copy.
  2. Select Edit > Clone.
  3. Enter a Table Title.
  4. (Optional) Enter a Description.
  5. Click Clone Dataset.
  6. (Optional) Click Edit to edit your cloned dataset.
  7. (Optional) Click Pivot to open the cloned dataset in Pivot and create a visualization based on it.

Edit a table dataset

Use the Datasets listing page to edit selected table datasets. You can edit a table description, or you can edit the table with Table Views.

Add or edit a table dataset title or description

Table dataset descriptions are visible in two places:

  • The Dataset listing page, when you expand the table dataset row.
  • The Explorer view of the table dataset, under the dataset name.

To add or edit a table dataset title or description, follow these steps:

  1. On the Datasets listing page, find a table dataset whose description you would like to add or edit. Expand the dataset row by clicking the > symbol in the first column to see its current description.
  2. Select Edit > Edit title or description.
  3. Add or update the title or description.
  4. Click Save.

Edit a table dataset in Table Views

Use the Datasets listing page to open and edit a dataset in Table Views.

  1. On the Datasets listing page, find a table dataset that you want to edit.
  2. Select Edit > Edit table.
  3. Edit the table in Table Views.
  4. Click Save.

For more information about using Table Views, see View and update a table dataset.

Update table dataset permissions

New table datasets are private by default and are available only to the users who created them. If you want other users to be able to view or edit a private table dataset you can change its permissions.

Note: By default, only the Power and Admin roles can set permissions for table datasets.

On the Datasets listing page, select Edit > Edit Permissions for the table whose permissions you want to edit. You can see whether the table is shared with users of a specific app or globally with users of all apps. You can also see which roles have read or write access to the app.

For information about setting permissions, see Manage knowledge object permissions.

Share private table datasets that you do not own

If you want to share a private table dataset that you do not own, you can change its permissions through the Data Models management page in Settings. You cannot see private datasets that you do not own in the Datasets listing page.

  1. Select Settings > Data models.
  2. Locate the table dataset that you want to share and select Edit > Edit Permissions.
  3. Share the dataset at the App or All apps level, and set read/write permissions as necessary.
  4. Click Save.

When you return to the Datasets listing page, verify that the dataset is visible and has the new permissions that you set for it.

Manage table dataset acceleration

Table datasets that contain a large amount of data can be accelerated so that their underlying search completes faster when you view the dataset or visualizations that are backed by it. Table acceleration only applies to table datasets when the tstats or pivot commands are applied to the table datasets.

On the Datasets listing page, accelerated table datasets and data model datasets have a yellow lightning bolt icon. On the Datasets listing page, select Edit > Edit Acceleration for the table you want to accelerate.

For more information about enabling and managing table acceleration, including caveats and restrictions related to table acceleration, see Accelerate tables.