dataset
Runs a query defined as a dataset with the owner's privileges. Users with access to a dataset can run queries with the dataset owner's privileges.
Command properties
| Item | Description |
|---|---|
| Command type | Driver query |
| Required permission | None |
| License usage | Counted |
| Parallel execution | Supported |
| Distributed execution | Not supported |
Syntax
Options
guid=STR- GUID of the dataset to run.
Error codes
Parse errors
| Error code | Message | Description |
|---|---|---|
| 300101 | Invalid session. | The Sonar session is not valid. |
| 300105 | Invalid guid option format. | The GUID format is incorrect. |
| 300106 | No data access permission. | You do not have access permission for the dataset. |
| 300107 | Dataset does not exist. | No dataset with the specified GUID exists. |
| 300108 | Dataset owner does not exist. | The dataset owner's account has been deleted. |
| 300109 | Cannot call itself. | The dataset is calling itself recursively. |
| 300110 | Specify the guid option for the dataset command. | The guid option is not specified. |
Runtime errors
N/A
Description
The dataset command runs the query stored in a dataset as a subquery. It creates a session with the dataset owner's identity and runs the query with the owner's privileges. This allows users with access to the dataset to access data they do not directly have permission for.
Only the dataset owner, cluster administrator, organization administrator, or users with whom the dataset is shared can run this command. Other users receive a permission error.
Recursive calls where a dataset calls itself are not allowed. If the same dataset GUID is detected in the call stack, a parse error occurs.
When query execution completes, the owner session is automatically terminated.
Examples
-
Running a dataset
dataset guid="550e8400-e29b-41d4-a716-446655440000"Runs the query defined in the dataset with the specified GUID using the owner's privileges.
-
Applying a processing query to dataset results
dataset guid="550e8400-e29b-41d4-a716-446655440000" | search src_ip == ip("192.0.2.1") | stats count by dst_portFilters records from the dataset results where the source IP is 192.0.2.1 and aggregates the count by destination port.