sonar-datasets

Retrieves the list of all datasets registered in Logpresso Sonar. Also returns properties such as each dataset's GUID, name, type, owner, and sharing targets.

Command properties

Property	Description
Command type	Driver query
Required permission	Administrator
License usage	Counted
Parallel execution	Not supported
Distributed execution	Not supported

Syntax

sonar-datasets

Options

None

Output fields

Field	Type	Description
guid	string	Dataset GUID
name	string	Dataset name
description	string	Dataset description
type	string	Dataset type. One of `query` (query-based) or `pivot` (pivot-based)
owner_guid	string	GUID of the dataset owner
owner_name	string	Name of the dataset owner
app_code	string	The code of the app the dataset belongs to. `null` for datasets created directly, independent of any app
shared_users	array	List of shared users. Each item is an object with `guid`, `name`, `type`, `read_only`, and `created` fields, where `created` is a string in `yyyy-MM-dd HH:mm:ssZ` format rather than a timestamp value
shared_groups	array	List of shared user groups. Each item is an object with `guid`, `name`, `type`, `read_only`, and `created` fields, where `created` is a string in `yyyy-MM-dd HH:mm:ssZ` format rather than a timestamp value
created	timestamp	Creation date
updated	timestamp	Last modification date

Error codes

Parsing errors

Error code	Message	Description
300172	No permission to list datasets	Run by an account without administrator permission

Runtime errors

N/A

Description

The sonar-datasets command targets all registered datasets, without any filter. Because it runs with administrator permission, all datasets are returned regardless of owner or sharing settings, and on installations with multiple companies (tenants) registered, datasets from other companies are included as well. It also includes datasets that widgets reference and datasets that you can run with the dataset command, so to check specific datasets only, you must chain a search or fields command afterward to filter.

To clone a dataset you have queried, use the sonar-clone-datasets command.

Examples

Retrieve the full list of datasets
```
sonar-datasets
```
Returns the properties of every dataset registered in the system.
Aggregate the count of datasets by type
```
sonar-datasets
| stats count by type
```
Groups datasets by the query and pivot types and aggregates the count.
Query only datasets that belong to a specific app
```
sonar-datasets
| search app_code == "threat-intel"
```
Filters only datasets created by the app whose app_code is threat-intel.

Change history

The sonar-datasets command is available in the Sonar 4.0 series starting with 4.0.2609.0, where the command previously provided by the Experimental app was built into Sonar core. On versions without the built-in command, install the Experimental app to use it.