service
service
Open the observability detail page for a single service — RED metrics (rate, errors, duration), top endpoints, and latency — directly from the search bar.
Description
The service command is a command-page: instead of returning rows, it paints the curated service-detail surface for the named service, the same view as the Observability console's Services drill-in. It reads from OpenTelemetry spans (otel_spans), not the logs table.
Like asset, tree, and cloud, service is a page directive — it routes the search bar to a built surface rather than transforming events. It short-circuits: no ClickHouse scan is issued, and any search expression before the command is ignored. The page fetches its own RED/endpoint/latency data for the requested service.
Syntax
| service <name>Arguments
name (required)
Syntax: service <name>
Description: The service to open (e.g. checkout, payments-api). Quote names containing spaces.
What the page shows
- RED metrics: request rate, error rate, and duration percentiles (p50/p95/p99) over the selected time range
- Endpoints: the busiest operations for the service, with their own RED breakdown
- Latency: request-duration distribution
- Drill-in: jump from an exemplar to its full trace waterfall
Examples
Open a service
| service checkoutA service whose name has spaces
| service "web frontend"Usage Notes
Terminal command: service must be the final command in the pipeline. Used mid-pipeline (e.g. | service checkout | stats count) it is rejected — it is a page directive, not a transform.
No scan: the command does not read the logs table; the base search is ignored. It opens the curated service surface and that surface fetches its own data.
Requires OTLP data: the service detail is populated from ingested OpenTelemetry spans. Without spans for the named service the page renders empty.