Overview tab
The Overview tab in Explore turns the records returned by your query into a sortable, aggregated view — top contributors, distributions, and bar or pie visualizations — so you can see where the load is concentrated without rebuilding the query as a chart. The Logs and Template tabs sit alongside it for raw records and shared-message grouping.
When to use the Overview tab
Use the Overview tab when you want the shape of the data, not the events themselves:
- Find the heaviest contributors. Rank services by error count, regions by traffic, or subsystems by log volume.
- Find the low end of the distribution. Order ascending with a small limit to surface short-duration services that may be failing fast or low-volume subsystems that may have stopped reporting.
- See the distribution at a glance. A pie or bar visualization makes it easy to tell which severity, status, or service dominates.
The Overview tab works across logs, spans, traces, and flows. Pick the dataset at the top of Explore and the same Overview surface follows.
How the Overview tab populates
The Overview tab is driven by the same Group by and Aggregation you set in Query Builder:
- In Builder mode, apply a Group by or an Aggregation and Explore moves you to the Overview tab automatically — the aggregated shape is what you came for, so it leads.
- Clear the Group by and Aggregation, and the Logs tab takes the lead again.
- For queries with no time bucketing, the Overview tab shows a count by default even before you add an aggregation, so you always see something useful when you land there.
Order and Limit
The Order and Limit chips at the top of Explore only affect the Overview tab. They never reshape the Logs or Template tabs.
- Order descending to surface the busiest groups — top duration, top error rate, top throughput.
- Order ascending with a small limit to find the quiet outliers. For example, group by
service.name, aggregateavg(duration), set order to ascending, and set the limit to 10 — the slowest-reporting services surface at the top of the table. - The default limit is 100. Lower it to focus on the leaders; raise it when you need the full distribution.
Visualizations
The Overview tab includes bar and pie visualizations that share the chart legend's data, presented so you can rank, filter, and drill into it.
Visualizations apply to non-time-bucketed groupings — for example, a count grouped by service.name. Time-bucketed series stay in the main chart above the result panel.
The Logs and Template tabs
The Logs and Template tabs share the same result panel and respond to the same dataset and time range, but they answer different questions:
- Logs — every raw record (log, span, trace, or flow) the query matched, up to the result cap, in your configured columns. Use it to inspect specific events, walk forward and back in time, or export rows.
- Template — high-volume logs grouped by shared message structure. Use it to find new, rare, or recurring patterns when scanning raw records is impractical. See Log Templates for the full feature.
Switching tabs preserves your query, filters, and time range — only the way the result is presented changes.
Related resources
Next steps
Build an aggregated query in the Query Builder, then switch back to the Logs tab to drill into the records behind each row.