Dataset management

Dataset Management is the central place to view, configure, and create datasets across your dataspaces. Navigate to Data Flow, then Dataset Management.

The page is organized into tabs by dataspace:

• Default — view predefined datasets and create user-defined datasets
• System — enable or disable Coralogix-managed system datasets

Default datasets

The Default tab lists all datasets in the default/ dataspace. The predefined logs and spans datasets are shown as placeholders and cannot be edited. User-defined datasets you create appear below them.

Hover over a dataset row to access the following actions:

• :cx-actions-edit: Edit the dataset description and access policy.
• :cx-actions-delete: Delete the dataset.
• :cx-system-explore-logs: View in Explore to open the dataset with the query source default/<dataset-name> pre-filled.

Create a user-defined dataset

Create a custom dataset to isolate a specific log stream, apply access policies, and route data to it via TCO Optimizer.

1. Select the Default tab.

2. Select Create Dataset.

3. In Dataset name, enter a unique name. Names must be unique within default/ and cannot be changed after creation.

4. In Description, enter an optional description.

5. In Bucket name, the storage bucket is inherited from your archive configuration. Optionally, enter a different bucket name.

6. Under Access Policy, optionally toggle Enabled Access Policy on to restrict access and configure exception rules.

   warning

   When the access policy is disabled, everyone has read access to the dataset. When enabled, you can create exceptions to this default behavior.

7. Select Create.

For a full walkthrough including TCO routing and access control, see User-defined datasets.

---

System datasets

The system/ dataspace contains Coralogix-managed datasets that store internal metadata about your environment, including schema changes, alert history, and audit logs.

System datasets must be manually enabled before they start ingesting data.

Hover over a dataset row to access the following actions:

• :cx-actions-edit: Edit the access policy.
• :cx-system-explore-logs: View in Explore to open the dataset with the query source system/<dataset-name> pre-filled.

Enable or disable a dataset

For both default and system datasets, toggle Write Access to start or stop data ingestion. Read access and other actions are determined by the access policy.

Once enabled:

• All users can query the dataset.
• The dataset counts toward your daily ingestion quota.
• Previously ingested data remains accessible even if you later disable the dataset.

Disabling a dataset stops ingestion but does not delete or archive stored data.

note

The notification.deliveries dataset is hosted by Coralogix and enabled by default for all environments. It does not count toward your ingestion quota. Alerts record delivery failures, while Cases record both successful and failed deliveries.