query-patterns

Use P99 or P95 on duration_ms instead of AVG, which hides tail latency. Filter on is_root to measure user-facing latency, group by http.route or name, and combine COUNT, P99, and HEATMAP in one query for a complete picture.

Relational prefixes (root., parent., child., any., none.) let filters and breakdowns reference other spans within the same trace. For example, any.service.name finds traces where a specific service participates, while none. excludes traces containing matching spans.

Use HEATMAP when you suspect a bimodal or multi-population distribution that single-number aggregates hide. A P99/P50 ratio above 10x is a signal to run HEATMAP to confirm two distinct latency bands.

No. This guidance covers trace and event datasets only; metrics datasets (dataset_type=metrics) are explicitly out of scope and should use a dedicated metrics-queries approach instead.

EQUALS uses strict type matching, so comparing an integer 200 against a string-typed status code silently returns false. Use find_columns to verify the field type, or normalize with INT() or STRING() casts before comparing.

Each query result's metadata includes a query_result_json signed URL. Download it with curl or Python and parse with jq to access exact numeric values, full time series, and heatmap bucket counts beyond the ASCII rendering.