Apologies @robertlynch2020 - I overlooked this - even we extracted it! Lets try again: | windbag
| head 1
| eval _raw="{\"resourceSpans\":[{\"resource\":{\"attributes\":[{\"key\":\"ser...
See more...
Apologies @robertlynch2020 - I overlooked this - even we extracted it! Lets try again: | windbag
| head 1
| eval _raw="{\"resourceSpans\":[{\"resource\":{\"attributes\":[{\"key\":\"service.name\",\"value\":{\"stringValue\":\"trade-blotter\"}},{\"key\":\"service.namespace\",\"value\":{\"stringValue\":\"trade-blotter-public\"}}]},\"scopeSpans\":[{\"spans\":[{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"abc123\",\"name\":\"referenceDataBuildClient\",\"startTimeUnixNano\":\"1746628424928265438\",\"endTimeUnixNano\":\"1746628424928267680\"},{\"traceId\":\"61df555eabf3b66cd8933809f00e409f\",\"spanId\":\"def456\",\"name\":\"readLiveQuery\",\"startTimeUnixNano\":\"1746628424928290524\",\"endTimeUnixNano\":\"1746628424928301728\"}]}]}]}"
``` main section of query below ```
| spath resourceSpans{}.resource.attributes{} output=resourceAttributes
| eval service_name=mvfilter(match(resourceAttributes,".*service.name\""))
| eval service_namespace=mvfilter(match(resourceAttributes,".*service.namespace"))
| foreach service_name*
[| eval <<FIELD>>=json_extract(json_extract(<<FIELD>>,"value"),"stringValue") ]
| spath resourceSpans{}.scopeSpans{}.spans{} output=scopeSpans
| stats count by scopeSpans, service_namespace
| spath input=scopeSpans
| rename startTimeUnixNano as start
| rename endTimeUnixNano as end
| eval _time=start/pow(10,9)
| eval duration = end -start
| eval duration= duration/1000000
| eval duration = round(duration,0)
| eval parentSpanId =if(parentSpanId="" ,"0", $parentSpanId$)
| rename name as SPAN_TYPE
| search traceId = 61df555eabf3b66cd8933809f00e409f
| table _time SPAN_TYPE spanId service_namespace duration
| sort _time Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing