Skip to content
Telemetry
Explore

Build event charts with filters and aggregations

Choose fields, filters, and aggregations in Explore to build a table or chart. You can view the generated SQL and edit it in Query.

Outcomes

  • Check sample rows to see whether new events contain the values you expect.
  • Build common time-series views with filters and aggregations.
  • Open the generated SQL in Query to add joins or other calculations.

How it works

How to set it up

1

Inspect samples first

Confirm that fields contain the expected values and types before aggregating them. This catches instrumentation mistakes early.

2

Choose what to measure

Select an aggregation, numeric field, time bucket, and filters. The newest time bucket may still be receiving events.

3

Save the chart

Save charts you check regularly to a dashboard, or use them to create alerts. Open Query when you need multiple tables or CTEs.

Exploring structured events

Inspect event samples, apply filters, and chart the results in Explore.

Boundaries

What this does not replace

  • Explore works with one table at a time. Use Query for joins, multiple CTEs, and reusable SQL.
  • A chart cannot compensate for incomplete instrumentation, mixed units, or unstable route and event names.
  • Filter by individual identifiers when investigating an event. Grouping a chart by thousands of identifiers makes it hard to read.

Try the example

Read the schema, SQL, and sample result

This example includes the schema, read-only SQL, and synthetic results. Use it to check how the query works. It does not measure customer results.

1. Event schema

One row in api_requests, with the types used by the query made explicit.

timestamp_utc
Timestamp
route_template
Utf8
status_code
Int64
latency_ms
Float64
Browse event contracts

2. Read-only SQL

Which API routes have the highest 5xx error rate with at least 20 requests?

SELECT
  route_template,
  COUNT(*) AS requests,
  SUM(CASE WHEN status_code >= 500 THEN 1 ELSE 0 END) AS errors,
  100.0 * SUM(CASE WHEN status_code >= 500 THEN 1 ELSE 0 END)
    / NULLIF(COUNT(*), 0) AS error_rate_pct
FROM api_requests
WHERE timestamp_utc >= now() - INTERVAL '24 hours'
GROUP BY route_template
HAVING COUNT(*) >= 20
ORDER BY error_rate_pct DESC
LIMIT 10;

3. Synthetic result

Checkout failed on 5 of 25 requests. Search failed on 1 of 25.

route_templaterequestserrors
/api/checkout255
/api/search251
/api/profile200
Inspect query, result, and caveats

Capabilities

What is included

Samples and table views for raw event inspection
Line, bar, and stacked-area charts
Count, sum, average, min, max, and percentile aggregations
Time ranges, nested-field filters, split series, and explicit columns
Add-to-dashboard and create-alert actions from results

See the analysis

SQL recipes that use this capability

Customer evidence

How teams use this workflow

Related capabilities

Related guides and examples

Start with one production workflow

Use a focused prompt, send synthetic events, and verify the first useful query before expanding coverage.