Spans Query Skill

Query and analyze distributed tracing data using the cx spans command with DataPrime syntax.

Understanding Spans in Coralogix

Spans are the fundamental unit of tracing data. Traces are not stored as single entities — they are logical groupings of spans that share the same traceID. To analyze a trace, you query its constituent spans.

This means:

• Metadata ($m.*) and labels ($l.*) are predictable — you can always filter on timestamp, duration, service name, and operation name without discovery.
• User data ($d.*) contains trace identifiers (traceID, spanID, parentSpanID) and application-specific tags/attributes that vary by service. Always verify custom $d fields before assuming they exist.

CLI Command

cx spans '<dataprime_query>'