nano SIEM
Search Commands

trace

trace

Open the distributed-trace waterfall for a trace id directly from the search bar.

Description

The trace command is a command-page: it paints the trace-waterfall surface for the given trace id — the time-ordered span hierarchy of a single distributed request — sourced from OpenTelemetry spans (otel_spans).

Like asset, tree, and cloud, it is a page directive and short-circuits: no ClickHouse scan is issued and any search expression before it is ignored. The page fetches the trace's spans directly.

Syntax

| trace <id>

Arguments

id (required) Syntax: trace <id> Description: The trace id to open (hex). Typically copied from a span, an exemplar on the service page, or a search result.

What the page shows

  • Waterfall: every span in the trace, ordered by start time and nested by parent/child, with per-span duration bars
  • Span detail: name, service, kind, status, and timing for each span
  • The critical path and where latency accumulates across services

Examples

Open a trace by id

| trace 7b3a9c1d2e4f5a6b8c9d0e1f2a3b4c5d

Usage Notes

Terminal command: trace must be the final command in the pipeline.

No scan: the command does not read the logs table; it opens the curated waterfall, which fetches the trace's spans directly.

Requires OTLP data: populated from ingested OpenTelemetry spans. An unknown id renders an empty waterfall.

  • service - Open a service detail page (jump to a trace from an exemplar)
  • services - Services overview
  • metric - Open the metric time-series explorer
On this page

On this page