Datasets

Datasets

A dataset is a saved, transformed result of a search: a sequence of transform operations applied to a query, kept as a named, reusable object. Where a saved search stores the query, a dataset stores the query plus the shaping — the field removals, renames, filters, joins and aggregations you apply to make the result useful.

Datasets are the platform’s answer to “saved search with transforms”: you build one, then re-run it by name from any query with from dataset:<name>.

Building a dataset

From a search result, save it as a dataset and then apply transforms. The available operations:

• Initialize — the starting field set.
• Remove / Move / Rename field — prune and tidy columns.
• Filter — by content or by relationship.
• Replace — replace field contents; distinct — deduplicate.
• Field map — remap field names.
• Calculated field (eval) and calculation time (eval-time) — derive new values.
• Join — associate another dataset.
• Stats — aggregate.
• Regular extraction — parse fields with a regex.
• Concatenate field / convert to string — reshape values.

Each step is a row in the chain, editable and reorderable, with sample data previewed so you can see the effect before saving.

Using a dataset

A dataset is referenced by name in a query:

from dataset:my_dataset | stats count() by service

It also appears in the dataset list, where it can be opened, visualized, and exported as a configuration.

Related

• Search — where a search becomes a dataset.
• SonQL — the from dataset: syntax.
• Reports and dashboards — a dataset is one kind of saved result; a report is another.
• Search actions and macros — other ways to reuse query fragments.