Skip to main content
The Explore workspace keeps telemetry results and investigation details in one view. Use it to move from a log to its trace, inspect the span waterfall, open related events, or review a session without losing the result list.

​
Choose a signal

Choose Explore under Investigate, then select one of these signals:
  • Logs for structured events, stack frames, attributes, and related traces.
  • Traces for distributed traces, span waterfalls, events, links, and related logs.
  • Sessions for replay search, playback, activity, and related telemetry.
The signal switcher keeps the active time range and environment. Logs and Traces also keep a compatible service filter. Each signal has its own search input so a query for one data type does not create a false filter on another data type.

​
Filter each signal in the same place

Logs, Traces, and Sessions use the same filter sidebar. The time range stays at the top of the sidebar when you change signals, so the result list does not move to a different layout. The remaining controls match the selected signal:
  • Logs include level, service, environment, source, release, connector, and attribute facets.
  • Traces include searchable environment, namespace, service, root span, HTTP method, HTTP status code, trace status, and duration filters. Duration presets cover common ranges, and custom values accept units such as 500µs, 250ms, or 1.5s.
  • Sessions include error status and environment filters.
On a narrow screen, select Filters to open the same controls in a modal panel. The row above the results reports how much work the last query used. It shows the elapsed query time, bytes and rows scanned when the data store reports them, rows returned, and response bytes. Updating means Squasher is refreshing the result set; Current means the displayed statistics match the latest completed query.

​
Keep the investigation in one view

Select a log or trace to open a wide viewer with Previous and Next controls. On a laptop, part of the result list stays visible beside it. The header stays in place while you scroll the viewer content; horizontal scrolling stays inside the log table or span timeline. Trace rows show the HTTP method, service, status, and duration before you open the viewer. Service colors are generated from the service name, so one service keeps the same color in the result table, waterfall, and span details. They do not require user configuration. Very short durations can use microseconds or nanoseconds instead of rounding to zero milliseconds. For logs, use the Event, Trace, Related, and Raw tabs. For traces, use the Waterfall, Related logs, and Raw tabs. Select a span in the waterfall to inspect its overview, attributes, events, links, or raw record. Raw records use indented JSON with syntax colors. Related logs use the same expandable log table as the main results and start loading when you open the viewer. When a log and trace share an identifier, you can move between them in the viewer. Use the Back control to return to the prior event or trace. On a narrow screen, the viewer becomes a modal panel and returns keyboard focus to the result that opened it.

​
Share a specific investigation

The URL stores the selected log, trace, span, session, and active detail tab. You can copy the URL, reload the page, or use browser Back and Forward without losing the current investigation. Existing links to the former Metrics, Services, Charts, and Service Map dashboard pages redirect to the applicable Logs or Traces view. Metrics remain available through dashboards, the API, CLI, and MCP tools.

​
Open source locations

When telemetry includes a safe file path and line number, the Event or span overview shows the source location. If the project has a matching GitHub repository and revision, select Open in GitHub to open the file at that line. For trace source locations, send OpenTelemetry code attributes such as code.file.path, code.line.number, and code.function.name. See OpenTelemetry integration to send traces and resource attributes.