Query builder for spans

The Spans and Traces tabs of Explore spans extend the standard Coralogix query builder with two controls tailored to span data: error filters and duration filters. Both apply to the active tab and stay in sync with your search, Group by, and aggregation choices.

Toggling the Errors filter or selecting Apply on Duration runs the query automatically—the results table and the count chart above it update in place.

For the shared building blocks—search bar, Lucene and DataPrime modes, Group by, Aggregation, Order by, Limit, Having, and drilling down into grouped results—see the main Query builder doc.

Filter by error

Use the Errors toggle to narrow results to spans or traces that include an error.

• In the Spans tab, the toggle shows only spans whose status indicates an error.
• In the Traces tab, it shows traces that contain at least one error span.

Combine the error toggle with a service or operation filter to jump straight to failing executions without rewriting your query.

Filter by duration

Use the Duration control to isolate slow operations.

• In the Spans tab, filter by span duration. Trace duration is not currently supported.
• Enter a minimum and maximum in milliseconds, or choose a percentile (p25, p50, p75, p95, p99). For example, p95 shows only spans slower than 95% of all spans in the current result set.
• Select Apply to execute the filter—this triggers an automatic query run.

The duration filter applies to the active tab and updates the results table and the count chart above it simultaneously.

Examples

End-to-end queries that combine the controls above with the shared builder primitives.

Find slow database spans:

1. Tab: Spans.
2. Search: db.system:*.
3. Duration: 500ms – ∞, or p95.
4. Group by: db.operation.
5. Aggregation: count.

Result: a grouped list of DB operations with counts, sorted by frequency—helping you identify which query type is slowest.

Find error spans in the checkout service:

1. Tab: Spans.
2. Search: coralogix.metadata.serviceName:"checkout-service".
3. Errors toggle: on.

Result: every error span produced by the checkout service in the active time range.

Find the slowest checkout requests that errored:

1. Tab: Spans.
2. Search: coralogix.metadata.serviceName:"checkout-service".
3. Errors toggle: on.
4. Duration: > p95.

Result: the slowest 5% of error spans in the checkout service—useful for tail-latency error investigation.

DataPrime equivalent for the slow database spans example:

source spans
| filter db.system != null
| filter $m.duration > 500000000
| groupby db.operation
| aggregate count() as span_count

Next steps

Investigate a span or trace in depth in Span drilldown.