Explore spans

Overview

Explore spans is a single investigation page that brings tracing data, span counts over time, and service flows together so you can move from a symptom—a latency spike, an error rate increase, or unexpected behavior—to root cause without losing context.

The page is organized around three tabs that share the same query, time range, and filters. You switch tabs when the question changes:

• Spans (default) answers which operation explains the behavior.
• Traces answers which end-to-end request best represents the problem.
• Flows shows how services communicate across the request.

The active query and filters apply to every tab, so switching tabs reframes the same data without restarting your investigation.

Prerequisites

Explore spans relies on correct trace context propagation across services. Most investigation issues occur when trace context is missing or not configured consistently, resulting in fragmented traces and disconnected spans.

Coralogix tracing follows OpenTelemetry (OTel) requirements. For an overview of required tracing concepts and context propagation, see the OpenTelemetry documentation.

How you arrive at Explore spans

You typically enter Explore spans from one of several paths:

• Alerts and SLOs: an error-rate or latency SLO is breached. From the SLO drilldown, you land in Explore spans already filtered to the affected service and time range.
• Direct exploration: you open Explore, select the spans dataset, and scope by service, operation, or time range.
• Cases and escalations: an issue is escalated by another team and you investigate production behavior using the Spans or Traces tab.

Three tabs, one investigation

Each tab renders the same matching data with a different shape. Pick the tab that matches your current question.

Spans tab

Use the Spans tab to find the specific operation that explains a symptom. Each row is a single span. The Spans tab is the default starting point because most investigations resolve at the operation level—a slow database call, a 500 from a downstream service, a failing message handler.

The Span kind column shows the role each span plays (SERVER, CLIENT, PRODUCER, CONSUMER, INTERNAL) with a directional arrow next to each row. Filter by SERVER to focus on inbound requests, or by CLIENT to investigate outbound calls to dependencies.

Traces tab

Use the Traces tab when you need the full request lifecycle. Each row is a single trace. The Traces tab is the right starting point when you want to compare end-to-end durations, error status, or service coverage across requests, or when you don't yet know which operation is responsible.

All fields and tags shown for a trace come from its root span.

Flows tab

Use the Flows tab to see how services communicate across the requests in your current query. The map aggregates every trace that matches the active query and time range. Selecting a node filters the Spans and Traces tabs to the traces that pass through that node, so you can jump from the map straight to the underlying rows.

Investigation flow

A typical investigation in Explore spans follows the same shape no matter which tab you start on:

1. Scope the query. Open Explore spans, select the spans dataset, set the time range, and add the filters that match your symptom (service, operation, error status).
2. Pick the tab that matches your question. Spans for an operation-level question, Traces for a request-level question, Flows for a topology question.
3. Narrow with the side bar and query builder. Add filters from the side bar, toggle Errors to focus on failing executions, or use the Duration control to isolate slow operations. The count chart, the results table, and the active tab all update in place.
4. Group and aggregate when you need to compare across services or operations—for example, group by service and aggregate by count or p95 duration to compare latency across services.
5. Drill into a representative span or trace. Select any row in the Spans or Traces table to open the drilldown drawer with full context preserved.

At any point you can switch tabs without restarting—the query and filters carry over.

Count chart above the results

A Count Spans over time chart sits above the results table and updates with the active query and time range. Each bar shows the number of spans in a time bucket so you can spot volume trends before drilling into individual spans—a spike in error spans or an unusual surge is often visible in the chart before it's reported as an incident.

Drilldown: validate findings without leaving the page

Selecting any row in the Spans or Traces table opens the span drilldown drawer, where you validate findings and gather all relevant context without leaving Explore spans. The drilldown brings together structure, timing, and metadata so you can answer why a request behaved the way it did.

Visualize and validate

The drilldown provides multiple ways to visualize a single trace, so you can validate assumptions and understand behavior from different angles. Switch between the Dependencies, Gantt, and Flame views to:

• Understand structure, dependencies, and timing.
• Confirm where latency accumulates or where execution diverges.
• Correlate spans with events, logs, and other telemetry.

For detailed explanations of each visualization mode, see Visualize spans and traces.

Info panel: your source of truth

The Info panel appears alongside the selected trace or span and acts as a structured, searchable source of truth during an investigation. When you select a trace, the panel displays details for the root span.

From the Info panel you can copy values, pin important fields, or open related views to continue the investigation seamlessly. For a detailed breakdown of fields, tags, and visualization behavior, see Info panel.

Related data: correlated signals in one place

The drilldown includes a Related data section that brings together telemetry connected to the selected span, trace, or service—logs (including errors), events, profiling, infrastructure context, AI sessions, and AI insights. This keeps everything in the same view and reduces context switching.

For setup instructions and a deeper walkthrough of each tab, see Span related data.

Headers and quick actions

Trace and span headers surface key context (service, operation, status, duration, and time) so you can assess issues without opening the Info panel. Use header menus to copy values, include or exclude attributes in the query, open Logs Explore, or pivot to APM service context and Profiles. For more details, see Headers and quick actions.

Example investigation paths

SLO-driven investigation with span distribution

You notice that the error-rate SLO for a frontend service is breached and want to understand whether the issue is isolated or systemic.

1. Open the SLO drilldown and confirm an increase in HTTP 500 errors.
2. Navigate into Explore spans, already filtered to the affected service and time range. The Spans tab opens by default.
3. Toggle Errors in the query builder to narrow to failing spans, then group by http.route to see which endpoints are affected.
4. Select a representative span row to open the span drilldown drawer.
5. Use the span duration distribution heatmap in the drilldown to compare the selected span against recent similar spans (same service and operation):
   • Confirm whether the span falls outside the normal latency distribution.
   • Determine whether the slowdown is an outlier or part of a broader regression.
6. From the Info panel, navigate to related logs or databases to validate the cause of the error or latency.

This flow takes you from an SLO breach to concrete evidence of abnormal span behavior, then to the supporting context needed to confirm root cause.

Exploratory analysis across services

You want to understand how a request flows through your system and whether recent behavior looks different from normal.

1. Open Explore spans and filter by your service of interest and time range.
2. Switch to the Flows tab to see how services communicate within the matching traces.
   • Understand the order of activities across services.
   • See how requests move through microservices and message brokers such as Kafka, RabbitMQ, or SQS.
3. Identify unexpected dependencies or slow service interactions on the map. Select a node to filter the Spans and Traces tabs to the traces that pass through it.
4. Switch to the Traces tab to compare end-to-end durations and error status across the filtered set.
5. Switch to the Spans tab to analyze the specific operations responsible for the behavior and open the drilldown for a representative span.

Explore spans investigation principles

Use Explore spans as an investigation workflow, not just a visualization:

• Start broad, then narrow your focus.
• Pick the tab that matches your current question; switch tabs as the question changes.
• Compare behavior with the count chart before drilling into details.
• Let traces and flows guide you to the spans that matter.
• Use related data to confirm or challenge your assumptions.

By following this approach, you can move from symptoms to root cause with confidence, even in complex distributed systems.

Additional resources

Next steps

Learn the core concepts behind distributed tracing in Understanding traces and spans.