Skip to main content
Sumo Logic

View and investigate traces

Trace data is visualized through filtered trace lists and icicle charts allowing you to find and troubleshoot faulty transactions easily.

Traces page

Use Traces to search and view traces.

To open go to + New > Traces.

traces menu option.png

A new Traces page opens:

trace page with 200 status.png

You can view traces in a Table.


Click on any row to open the Trace View. Traces are displayed in the following columns:

Column name Example value Description
  #A Indicates the query returning the trace.
Trace ID ffaf2f69ee8ad0c1 The unique identifier of the trace.
Root Service api The service that started the trace.
Started At 07/27/2020 09:01:04.533 When the trace started.
Duration 12.582 ms The amount of time the trace spans. 
Number of spans 35 A trace consists of spans. This number tells you how many spans are in the trace.
Duration Breakdown breakdown.png Each color indicates a service. The colors assigned to services are always the same on your account. You can change the color in the span summary tab after clicking on the individual span in trace view.

Hover over to view a percentage breakdown of how long each span covers in the trace.

breakdown hover.png
Number of errors 0 The number of errors in the trace.
Status 200 The HTTP status code of the trace.

A menu is available in this column when hovering on a row.
similar traces menu.png
The menu has an option to Show similar traces.

Trace query

A trace query allows you to search for traces representing transaction flows through your system using the following filters:

  • Root Service: name of the service that started the trace
  • Any Service: name of a service that took part in the trace
  • Duration: time in milliseconds of the trace
  • Number of spans
  • Number of errors

To write a query click on the Choose filters input line. You can select the desired filter type and value from the drop down menu or manually type them. Multiple filters are allowed in a query row, AND is implicit.


You can add more queries by clicking the + icon on the right of the query row:

Add trace query.png

Each query is labeled with a letter, in the following screenshot the first query on the top row is labeled #A, the second query is labeled #B.

trace queries.png

Custom Filters

Administrators can add up to five custom fields for filtering traces.

  • The fields must be low-cardinality among any trace spans and a string data type.
  • Added fields are available after one business day.

To add custom fields:

  1. Click the three vertical dots on the top right of the Traces page.
    traces menu.png
  2. Select the Add custom field for filtering option to open the form. 
  3. Define the fields you want to add as filters. Click the Add new field link to add another field.  traces custom filters.png

Use the eye icon to toggle the visibility of results from a query. When hidden, the traces returned from the query in the row are not displayed in your results.

hide and show query results.png

Time range 

Results are returned for the time window selected. See Time Range Expressions for details on defining a time range.


The results are not automatically updated. If you want to refresh traces, click the refresh button on the top right corner of the page.


Trace View

Trace View shows the time flow of a single trace by its spans. To open, click on a trace row in the Traces table. Each color represents a different service.

trace view main.png

  • Use your mouse to drag and zoom in and out. To reset your view, click the Reset View button on the bottom left of the window.
    reset view.png
  • You can click the Critical path contribution by service bar at the top to filter out the services that are of less interest. The critical path is the sequence of span segments that contribute to the total trace duration.
    critical path on trace view.png
  • Use the Error Spans Only toggle to hide or show error spans and the Hide all services button to hide services.
    toggle and button hide.png
  • Hover over a span to view the parent span relationship.
    hover span.png
Details pane

Click on any span to open a side panel with details.

summary tab traces.png

The details pane provides the following tabs:

  • Summary
    • The details of the span are provided.
    • To drill down further into your data, the Logs section has links to run searches against related log data. Top links for span/trace IDs work if you have span and trace IDs injected into logs. Lower section links are available and work automatically if SumoLogic Kubernetes Collection is installed.
      Logs links.png
    • Service Color
    • The color of the Service can be changed by clicking the colored box and selecting a defined swatch or custom color.
      service color traces span.png
  • Metadata
    • Lists all of the related service entities involved in the span.
      trace details metadata tab.png
    • You can click on the clipboard icon to copy the value to your computer's clipboard.
      clipboard option.png
  • Entities

The Entities tab provides troubleshooting links for related Entities and Environments, as well as any Monitors with a Critical, Warning, or Missing Data status that are tracking logs or metrics on the Entity.

Only entity types from a curated list are identified. The AWS, Kubernetes, Traces, and Host domains are supported.

entities tab.png

To investigate, click the Open In button and select an icon to launch another feature against the entity or environment. An icon is not available if it isn't a valid launch.

infrastructure tab with RCE link.png

Time selector

Use the time selector to set if data is related to the "now" moment of time or the moment of time around the data point you clicked on.

entities time selector.png

time selector options.png

Triggered monitors

Monitors track your Metrics or Logs data in real time and send notifications when noteworthy changes happen in your production applications. The Entities tab shows any Monitors with a Critical, Warning, or Missing Data status that are tracking logs or metrics on the Entity.

Next to the Entity, you'll see any of the following icons indicating the type of Monitor alert that has triggered.

monitor types.png

Click the Triggered monitors row to view the related Monitors. You can click on them to view the Monitor on the Monitors page.

triggered monitors.png