yes i'm started doing a search based on the traceId and spanId  index=your_index sourcetype=your_sourcetype | fields trace_id, span_id, parent_span_id,app.name | rename app.name as current_service | join type=inner trace_id [search index=your_index sourcetype=your_sourcetype | fields trace_id, span_id, parent_span_id,app.name | rename app.name as parent_service, span_id as parent_span_id] | where parent_span_id = span_id | table trace_id, parent_service, current_service but i'm asking if there is a default fields related to microservices in Splunk  ... View more