Skip to content
Sondar

Datasets

A dataset is a saved, transformed result of a search: a sequence of transform operations applied to a query, kept as a named, reusable object. Where a saved search stores the query, a dataset stores the query plus the shaping — the field removals, renames, filters, joins and aggregations you apply to make the result useful.

Datasets are the platform’s answer to “saved search with transforms”: you build one, then re-run it by name from any query with | from dataset:<name>.

Building a dataset

Section titled “Building a dataset”

From a search result, save it as a dataset and then apply transforms. The available operations:

  • Initialize — the starting field set.
  • Remove / Move / Rename field — prune and tidy columns.
  • Filter — by content or by relationship.
  • Replace — replace field contents; distinct — deduplicate.
  • Field map — remap field names.
  • Calculated Field (eval) — derive a new value from existing fields.
  • Calculated Time (evalTime) — derive a value from a time field: a date part, or the difference between two times. It takes an explicit timezone, which defaults to the one your browser is in.
  • Join — associate another dataset.
  • Stats — aggregate.
  • Regular extraction — parse fields with a regex.
  • Concatenate field / convert to string — reshape values.

Each step is a row in the chain, editable and reorderable, with sample data previewed so you can see the effect before saving.

Using a dataset

Section titled “Using a dataset”

A dataset is referenced by name in a query. The query starts with the pipe — from is a pipeline command, so without it the query fails to parse at column 1 (measured 26 Sep 2026):

| from dataset:my_dataset | stats count() by service

It also appears in the dataset list, where it can be opened, visualized, and exported as a configuration.

Section titled “Related”