Ready to get started?

Walk through a complete investigation flow in the [Getting started](https://coralogix.com/docs/user-guides/data_exploration/spans/explore-spans/index.md) guide.

## Overview

Note

Explore spans is the new investigation experience for tracing data, replacing the legacy Explore Tracing page. Existing URLs continue to work via redirects.

[**Explore spans**](https://coralogix.com/docs/user-guides/data_exploration/spans/explore-spans/index.md) is a single investigation page that brings tracing data, span counts over time, and service flows together so you can move from a symptom—a latency spike, an error rate increase, or unexpected behavior—to root cause without losing context.

The page is organized around tabs that share the same query, time range, and filters. **Row-level tabs** show the matching spans or traces; **analytical tabs** reshape the same query into distributions, charts, and field breakdowns. You switch tabs when the question changes:

- **Spans** (default) answers *which operation explains the behavior*.
- **Traces** answers *which end-to-end request best represents the problem*.
- **Flows** shows *how services communicate across the request*.
- **Overview** answers *how the matching data is distributed* across services, operations, or status codes.
- **Signals** answers *what Rate, Errors, and Duration look like* for the active query.
- **Highlights** answers *which fields and values are driving* latency or errors.

The active query and filters apply to every tab, so switching tabs reframes the same data without restarting your investigation.

## What you need

Explore spans relies on correct trace context propagation across services. Most investigation issues occur when trace context is missing or not configured consistently, resulting in fragmented traces and disconnected spans.

Coralogix tracing follows OpenTelemetry (OTel) requirements. For an overview of required tracing concepts and context propagation, see the OpenTelemetry [documentation](https://opentelemetry.io/docs/concepts/signals/traces/).

## How you arrive at Explore spans

You typically enter **Explore spans** from one of several paths:

- **Alerts and SLOs:** an error-rate or latency [SLO](https://coralogix.com/docs/user-guides/slos/introduction/index.md) is breached. From the SLO drilldown, you land in Explore spans already filtered to the affected service and time range.
- **Direct exploration:** you open Explore, select the `spans` dataset, and scope by service, operation, or time range.
- **Cases and escalations:** an issue is escalated by another team and you investigate production behavior using the **Spans** or **Traces** tab.

## The tabs

Each tab renders the same matching data with a different shape. Pick the tab that matches your current question. The **Spans**, **Traces**, and **Flows** tabs show row-level and topology views; the **Overview**, **Signals**, and **Highlights** tabs reshape the same query into aggregated and analytical views.

### Spans tab

Use the **Spans** tab to find the specific operation that explains a symptom. Each row is a single span. The Spans tab is the default starting point because most investigations resolve at the operation level—a slow database call, a 500 from a downstream service, a failing message handler.

The **Span kind** column shows the role each span plays (`SERVER`, `CLIENT`, `PRODUCER`, `CONSUMER`, `INTERNAL`) with a directional arrow next to each row. Filter by `SERVER` to focus on inbound requests, or by `CLIENT` to investigate outbound calls to dependencies.

### Traces tab

Use the **Traces** tab when you need the full request lifecycle. Each row is a single trace. The Traces tab is the right starting point when you want to compare end-to-end durations, error status, or service coverage across requests, or when you don't yet know which operation is responsible.

All fields and tags shown for a trace come from its root span.

### Flows tab

Use the **Flows** tab to see how services communicate across the requests in your current query. The map aggregates every trace that matches the active query and time range. Selecting a node filters the **Spans** and **Traces** tabs to the traces that pass through that node, so you can jump from the map straight to the underlying rows.

### Overview tab

Use the **Overview** tab to see the active query as an aggregated visualization instead of row-level results—rank services by error count, surface the slowest operations, or see a status-code distribution at a glance. Group by and aggregation drive what's plotted. See [Overview tab for spans](https://coralogix.com/docs/user-guides/data_exploration/spans/overview-tab/index.md).

### Signals tab

Use the **Signals** tab to see Rate, Errors, and Duration for the active query. A button group switches between **Outliers** (latency percentiles, error counts, and individual span samples overlaid on one chart) and **RED metrics** (Rate, Errors, and Duration as three side-by-side charts). See [Signals tab](https://coralogix.com/docs/user-guides/data_exploration/spans/signals/index.md).

### Highlights tab

Use the **Highlights** tab to break the matching spans down by field and spot which services, endpoints, or status codes are driving a spike. Toggle **Compare to previous period** to surface regressions side by side. See [Highlights tab](https://coralogix.com/docs/user-guides/data_exploration/spans/highlights-tab/index.md).

## Investigation flow

A typical investigation in Explore spans follows the same shape no matter which tab you start on:

1. **Scope the query.** Open Explore spans, select the `spans` dataset, set the time range, and add the filters that match your symptom (service, operation, error status).
1. **Pick the tab that matches your question.** Spans for an operation-level question, Traces for a request-level question, Flows for a topology question.
1. **Narrow with the side bar and query builder.** Add filters from the side bar, toggle **Errors** to focus on failing executions, or use the **Duration** control to isolate slow operations. The count chart, the results table, and the active tab all update in place.
1. **Group and aggregate** when you need to compare across services or operations—for example, group by service and aggregate by `count` or `p95` duration to compare latency across services.
1. **Drill into a representative span or trace.** Select any row in the Spans or Traces table to open the drilldown drawer with full context preserved.

At any point you can switch tabs without restarting—the query and filters carry over.

## Count chart above the results

A **Count Spans over time** chart sits above the results table and updates with the active query and time range. Each bar shows the number of spans in a time bucket so you can spot volume trends before drilling into individual spans—a spike in error spans or an unusual surge is often visible in the chart before it's reported as an incident.

## Drilldown: validate findings without leaving the page

Selecting any row in the Spans or Traces table opens the **span drilldown** drawer, where you validate findings and gather all relevant context without leaving Explore spans. The drilldown brings together structure, timing, and metadata so you can answer why a request behaved the way it did.

### Visualize and validate

The drilldown provides multiple ways to visualize a single trace, so you can validate assumptions and understand behavior from different angles. Switch between the **Dependencies**, **Gantt**, and **Flame** views to:

- Understand structure, dependencies, and timing.
- Confirm where latency accumulates or where execution diverges.
- Correlate spans with events, logs, and other telemetry.

For detailed explanations of each visualization mode, see [Visualize spans and traces](https://coralogix.com/docs/user-guides/data_exploration/spans/visualize/index.md).

### Info panel: your source of truth

The **Info panel** appears alongside the selected trace or span and acts as a structured, searchable source of truth during an investigation. When you select a trace, the panel displays details for the root span.

From the Info panel you can copy values, pin important fields, or open related views to continue the investigation seamlessly. For a detailed breakdown of fields, tags, and visualization behavior, see [Info panel](https://coralogix.com/docs/user-guides/data_exploration/spans/info_panel/index.md).

### Related data: correlated signals in one place

The drilldown includes a **Related data** section that brings together telemetry connected to the selected span, trace, or service—logs (including errors), events, profiling, infrastructure context, AI sessions, and AI insights. This keeps everything in the same view and reduces context switching.

For setup instructions and a deeper walkthrough of each tab, see [Span related data](https://coralogix.com/docs/user-guides/data_exploration/spans/related_data/index.md).

### Headers and quick actions

Trace and span headers surface key context (service, operation, status, duration, and time) so you can assess issues without opening the Info panel. Use header menus to copy values, include or exclude attributes in the query, open Logs Explore, or pivot to APM service context and Profiles. For more details, see [Headers and quick actions](https://coralogix.com/docs/user-guides/data_exploration/spans/headers_actions/index.md).

## Example investigation paths

### SLO-driven investigation with span distribution

You notice that the error-rate SLO for a frontend service is breached and want to understand whether the issue is isolated or systemic.

1. Open the SLO drilldown and confirm an increase in HTTP 500 errors.
1. Navigate into **Explore spans**, already filtered to the affected service and time range. The **Spans** tab opens by default.
1. Toggle **Errors** in the query builder to narrow to failing spans, then group by `http.route` to see which endpoints are affected.
1. Select a representative span row to open the span drilldown drawer.
1. Use the **span duration distribution heatmap** in the drilldown to compare the selected span against recent similar spans (same service and operation):
   - Confirm whether the span falls outside the normal latency distribution.
   - Determine whether the slowdown is an outlier or part of a broader regression.
1. From the Info panel, navigate to related logs or databases to validate the cause of the error or latency.

This flow takes you from an SLO breach to concrete evidence of abnormal span behavior, then to the supporting context needed to confirm root cause.

### Exploratory analysis across services

You want to understand how a request flows through your system and whether recent behavior looks different from normal.

1. Open **Explore spans** and filter by your service of interest and time range.
1. Switch to the **Flows** tab to see how services communicate within the matching traces.
   - Understand the order of activities across services.
   - See how requests move through microservices and message brokers such as Kafka, RabbitMQ, or SQS.
1. Identify unexpected dependencies or slow service interactions on the map. Select a node to filter the **Spans** and **Traces** tabs to the traces that pass through it.
1. Switch to the **Traces** tab to compare end-to-end durations and error status across the filtered set.
1. Switch to the **Spans** tab to analyze the specific operations responsible for the behavior and open the drilldown for a representative span.

## Explore spans investigation principles

Use **Explore spans** as an investigation workflow, not just a visualization:

- Start broad, then narrow your focus.
- Pick the tab that matches your current question; switch tabs as the question changes.
- Compare behavior with the count chart before drilling into details.
- Let traces and flows guide you to the spans that matter.
- Use related data to confirm or challenge your assumptions.

By following this approach, you can move from symptoms to root cause with confidence, even in complex distributed systems.

## Additional resources

|      |                                                                                                                                                       |
| ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| Blog | [From trace to root cause: mastering the new trace drilldown](https://coralogix.com/blog/from-trace-to-root-cause-mastering-the-new-trace-drilldown/) |

## Next steps

Learn the core concepts behind distributed tracing in [Understanding traces and spans](https://coralogix.com/docs/user-guides/data_exploration/spans/trace-span-concepts/index.md).