Splunk® Enterprise

Knowledge Manager Manual

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Dataset extension



Example of extending a dataset as a report


If you save this search string as a report named Beta, it still has the reference back to Alpha. If someone decides to make a change to Alpha, that change cascades down to the Beta report. This change might cause problems in the Beta report.

For example, you might modify the search string of the Beta report with lookups and eval expressions that use fields passed down from the Alpha dataset in their definitions. If someone deletes those fields from the Alpha dataset, those lookups and eval expressions break in the Beta report, because they require fields that no longer exist.

Dataset extension chains

You can extend any dataset as a table dataset. This means that you can have chains of extended datasets. For example you can extend Dataset Alpha as dataset Beta, and then extend dataset Beta as dataset Gamma, and so on. Any change to Alpha propagates down through the other datasets in the chain.

You can understand dataset extension chains from the end of the chain, but not from the start. So to use the example in the preceding paragraph, if you are on dataset Gamma, you can see that it extends Beta, which in turn extends Alpha. But if you view Alpha, you have no way of knowing which datasets were extended from it.

Learn which datasets a dataset extends

Locate the dataset in the Datasets listing page and expand its row. If it extends one or more datasets, you will find an Extends line item with the extended datasets listed from top to bottom. For example, the following image shows the detailed information for Gamma, showing that it extends Alpha and Beta.



Use a naming convention for extended datasets


When you extend a dataset, you can update its description to indicate that it is extended. Identify the knowledge objects that have been directly extended from it, not the full extension chain, if one exists. Add a sentence like this to the dataset description: "This dataset has been extended as a table dataset named <dataset_name> and a report named <report_name>."

The from command

Dataset extension is facilitated by the from command, whether you extend it by opening it in the Search view or through Table Views.


| from datamodel:"Buttercup_Games_Purchases"

You can extend any dataset as a table dataset. When you do this, Table Views uses the from command in the background. Click the SPL toggle in the command history sidebar to see how Table Views uses the from command.

For more information, see from in the Search Reference.

Extension and table acceleration

If you want to accelerate a table that extends other tables, it needs to be shared with you, and the tables it extends must be shared with you as well. Acceleration can be applied only to datasets that use purely streaming commands commands.


You cannot accelerate a table that is extended from a lookup table file or lookup definition since lookup dataset extension isn't a streaming operation.

See Accelerate tables.

Last modified on 18 September, 2020
View and update a table dataset
Accelerate table datasets


Was this documentation topic helpful?



0 out of 1000 Characters