Overview tab for spans
The Overview tab is a dedicated surface in Explore for visualizing aggregated and grouped query results on the spans dataset. Instead of scanning row-level results to infer distributions, you can see them directly — by service, status code, operation, or any field — using the same query that drives the Spans, Traces, and Flows tabs.
The Overview tab reacts to the active builder query: as you adjust filters, Group by, or Aggregation, the visualization updates in place. No need to switch queries or contexts — the Overview tab reacts to the exact same query you're already using in the row-level tabs.
When to use the Overview tab
- You want to see the distribution of a metric across a dimension — for example, request count by service, error rate by status code, or p95 latency by operation.
- You want a scannable summary of the active query before drilling into individual rows.
- You want to compare values across groups in the same view — for example, sum of duration by service vs. by operation.
- You want to quickly identify which group (service, operation, or status code) is the outlier before drilling into individual rows.
For row-level inspection of a specific span or trace, use the Spans, Traces, or Flows tabs.
Default state
When you open the Overview tab without grouping or aggregation, the tab shows a single-row summary with the total span count for the active query. This default state is a quick review of how many spans match your current query before you start grouping.
As soon as you add a Group by or change the Aggregation in the builder, the Overview tab switches to the visualization you have selected and renders the grouped result.
How the Overview tab reacts to the builder
The Overview tab shares the active builder query with the row-level tabs. Any change you make in the builder applies to every tab:
- Filters from the side bar or the query bar narrow the result set in the Overview tab the same way they narrow the Spans, Traces, and Flows tabs.
- Group by in the builder drives the dimension on the visualization in the Overview tab. In the row-level tabs, the same Group by adds a column to the results table.
- Aggregation in the builder drives the value plotted in the Overview tab — for example,
count,avg,p95. In the row-level tabs, aggregation is also reflected in the column added by Group by.
Switching tabs preserves the query, so you can move between a high-level visualization and the underlying rows without restarting your investigation.
Visualize as
Use Visualize as to select how the Overview tab renders the active query. The picker is split into two groups, each with its own button. The default for over-time queries is Line chart; for not-over-time queries it is Table.
Graph (over time)
| Visualization | Use it when |
|---|---|
| Line chart | You want to see how a metric changes over the selected time range. |
| Stacked area | You want to compare contributions of multiple groups to a total over time. |
| Stacked bar | You want bucketed comparisons of group contributions over time. |
| Grouped bar | You want side-by-side comparison of groups in each time bucket. |
Table (not over time)
| Visualization | Use it when |
|---|---|
| Table | You want a sortable list of groups with their aggregated values. |
| Horizontal bar | You want to compare aggregated values across groups in a single snapshot. |
| Donut chart | You want to see proportional contributions of groups to a total. |
| Treemap | You want to compare many groups by relative size. |
The selected visualization persists with the tab. Switching the chart type does not re-run the query — the Overview tab re-renders the same result set in the new shape.
Common use cases for spans
Top services by error count
Rank services by their share of error spans to see where failures concentrate.
- Group by:
service.name - Aggregation:
count - Filter: toggle Errors in the query builder
- Order: descending
- Visualize as: horizontal bar or table
Slowest operations
Find the operations carrying the worst tail latency.
- Group by:
operation(orspan.name) - Aggregation:
p95(duration) - Order: descending
- Visualize as: horizontal bar or table
Status code distribution
See the share of 2xx, 4xx, and 5xx responses at a glance.
- Group by:
http.status_code - Aggregation:
count - Visualize as: donut chart
Quiet services
Surface services that may have stopped reporting spans — useful for catching silent regressions.
- Group by:
service.name - Aggregation:
count - Order: ascending
- Limit: 10
Always-on Group by and Aggregation
Group by and Aggregation in the builder are permanently enabled when the Overview tab is active. In the row-level tabs (Spans, Traces, Flows), Group by continues to behave as it does today: it adds a column to the results table rather than changing the rendering. To add or modify columns in the row-level tabs, use Manage columns.
Drill from a row to a span
Aggregated rows tell you where to look, not what happened. To inspect the underlying spans:
- Note the value driving the row — for example, the service or operation in the top row.
- Switch to the Spans tab. The query, filters, and time range carry over.
- Add a filter on the value from step 1, or select the value from the row's context menu to filter in place.
- Select any row in the Spans tab to open the span drilldown drawer with full context — fields, related logs, and visualizations.
For a request-level handoff, switch to the Traces tab. For a topology view, switch to Flows. The query carries over to all three.
DataPrime view
When you switch the builder to DataPrime, the result panel splits into two tabs:
- Overview tab — renders the DataPrime query result with Group by and Aggregation applied when the query expresses them. Behavior matches the builder's Overview tab.
- Result tab — row-level data for drilling into a specific span.
The graph renders when the DataPrime query is structured in a way the visualization layer can interpret. For complex queries the visualization layer can't render, the graph is disabled and only the Result tab is populated. The count over time graph above the result panel remains visible.
The DataPrime view exposes the same left-side Fields panel as the builder, with the same field actions (Filter in / Filter out, Search values, Show more, Sort) and the same section taxonomy.
Zero state and query routing
When you open Explore without an active query, a shared zero-state page appears for the spans dataset. The page presents pre-built queries shaped to land you in the right tab:
- Grouped or aggregated query — opens in the Overview tab, optimized for distributions and high-level insights.
- Row-level query (no grouping or aggregation) — opens in the appropriate row-level tab: Spans, Traces, or Flows, depending on the query.
The zero-state page opens when you:
- Open a New tab.
- Select Explore New.
The zero-state page does not open when you select the Spans Explore button — that opens directly into the Spans tab.
Limits and considerations
- The Overview tab applies aggregation and grouping as a full visualization. The row-level tabs continue to show rows; Group by in those tabs adds a column instead.
- For DataPrime queries the visualization layer can't interpret, the Overview graph is disabled. Use the Result tab.
- Switching the chart type does not re-run the query — the same result set is re-rendered in a new shape.
- Group by on high-cardinality span fields produces too many groups to render meaningfully. Avoid
span.id(every row is unique) andtrace.id(one group per trace — use the Traces tab instead). Prefer lower-cardinality fields likeservice.name,operation,http.status_code,http.method,span.kind, or resource attributes likecloud.regionandk8s.namespace.name.
Related resources
- Overview tab — general behavior across datasets.
- Explore spans — the full investigation workflow.
- Explore common components — query builder, fields, graphs, and result-table behavior shared with the other spans tabs.
- Span drilldown — what you see when you open a row from the Spans tab.
Next steps
See how the Spans, Traces, and Flows tabs render your results in Spans, Traces, and Flows.