source - Read your data

The source command is a foundational component of DataPrime. It informs the DataPrime engine which datasource you wish to read from.

Note

While you can start your query with this, the source command is optional and will default to logs.

Syntax

(source|from) <data_store>

There are three options for reading data in DataPrime:

logs - Data that has been ingested into Coralogix as a log. This is the default value.
spans - Data that has been ingested into Coralogix as a span, which is part of a trace.
A custom enrichment table, which has been declared via the API or the UI.

To inform dataprime you wish to perform your query on logs:

source logs

To inform dataprime you wish to perform your query on spans / traces:

source spans

To inform dataprime you wish to perform your query on a custom enrichment you have uploaded via the Coralogix UI or API.

source my_custom_enrichment_name

Enter the following into your explore screen:

source logs

You will see that it will pull all logs from the timeframe specified in the UI. The following command, however:

source spans

Will pull all traces, and not logs.