Skip to content

[DOCS-10679] Add blog and use cases to Reference Tables #30161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 30, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions content/en/reference_tables/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,9 @@ further_reading:
- link: 'https://www.datadoghq.com/blog/add-context-with-reference-tables/'
tag: 'Blog'
text: 'Add more context to your logs with Reference Tables'
- link: 'https://www.datadoghq.com/blog/reference-tables/'
tag: 'Blog'
text: 'Enrich your existing Datadog telemetry with custom metadata using Reference Tables'
- link: 'https://www.datadoghq.com/blog/add-context-with-reference-tables-in-cloud-siem/'
tag: 'Blog'
text: 'Add more context to Cloud SIEM detections and investigations with Datadog Reference Tables'
Expand All @@ -35,6 +38,25 @@ Reference Tables allow you to combine custom metadata with information already i

{{< img src="reference_tables/reference-table.png" alt="A reference table with data populated in the columns for org id, org name, parent org, account owner, and csm" style="width:100%;">}}

For example, you can:

- **Enrich logs and security data for faster investigations:** Correlate logs, traces, and security events with up-to-date business context—such as customer names, account owners, threat intelligence, or error code descriptions—to accelerate troubleshooting and analysis.
- **Segment users and resources for targeted analytics and cost management:** Group users, customers, or cloud resources into meaningful segments (like user tiers, teams, or business units) for deeper product analytics and precise cost attribution using tools like Tag Pipelines.
- **Enhance data for advanced querying and reporting:** Join external data from Reference Tables in Sheets, DDSQL Editor, or Log Workspaces to perform complex queries, aggregations, and build custom reports without technical expertise.

## Validation rules

Reference Table names and column headers are validated using the following naming conventions and automatically updated or normalized, if necessary.

| Rule | Normalization |
| ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| Names and headers cannot be duplicated. | Duplicated names are enumerated. For example, if `fileid` is used twice as a name, the first instance becomes `fileid1` and the second instance becomes `fileid2`. If a name or header is enumerated and it exceeds the 56 characters, it is rejected and needs to be renamed. |
| Names and headers cannot contain uppercase letters. | Names with uppercase letters are converted to lowercase. This conversion may result in duplicate names, which are then enumerated. For example, `Fileid` and `FileID` both become `fileid` and are enumerated to `fileid1` and `fileid2` respectively. |
| Names and headers cannot contain spaces. | Spaces other than leading and trailing spaces are replaced with underscore `_` characters. Leading and trailing spaces are removed. For example, `customer names` is replaced with `customer_names`. |
| Names and headers must start with a lowercase letter. | Uppercase characters are converted to lowercase. Non-letter leading characters are removed. For example, `23Two_three` becomes `two_three`. |
| Names and headers support only lowercase letters, numbers, and the `_` character. | Unsupported characters are replaced with the underscore `_` character, unless it breaks one of the rules above. In that case, the unsupported characters are normalized by the respective rule. |
| Names and headers must be 56 characters or less. | No normalization is done. Names and headers that have more than 56 characters are rejected and need to be renamed. |

## Create a Reference Table

Datadog supports the following data sources, including integrations and manual CSV upload:
Expand Down
Loading