Skip to main content
In Query Results, any VISUALIZE chart(s) displays first. Below, a series of tabs for further analysis appears, including:

​
Overview

The Overview view displays a summary table based on your query. If your query includes a GROUP BY clause, then the summary reflects a summary of grouped fields.

​
BubbleUp

The BubbleUp view activates after you select an area in a chart or heatmap. Honeycomb’s BubbleUp feature compares your selection to all other results, or the baseline. Each comparison is represented as a chart. A dataset or environment has many fields. BubbleUp represents each field with a chart. The charts divide into two groups:
  • Dimensions contain fields with categorical or ordinal values
  • Measures contain fields with numeric values
Each chart categorizes the data into two groups:
  • Selection, rendered in yellow on the right side of a value, contains the points in the area selected in the heatmap.
  • Baseline, rendered in blue on the left side of a value, contains all the points outside of the area selected.
BubbleUp dimensions chart example with annotations
The title of the chart is the name of the field. In the upper right corner, the two donut charts display a ratio of how often the field is found in the data. A field and its values may not be populated in a dataset or environment. Hover over the title and donut charts to display a tooltip with the full field name and a percentage of how often the field appears in the Selection (yellow) and Baseline (blue). The bar chart displays each value in bar form, which represents its frequency in the Selection or in the Baseline. The height of each bar is proportional to the number of times the value occurs in the results of the query. The bar chart displays a maximum of seventy-five values, a subset of both Selection and Baseline values. Hover over the bar for a value, to display a tooltip with its full value name and a percentage of how often the value appears in the Selection and Baseline.
BubbleUp dimension bar chart value tooltip when hovered
A field may contain largely unique values. These are sometimes referred to as nominal data. The tooltips for nominal columns show the exact number of occurrences instead of a percentage in the Selection or the Baseline. For example, events that capture a span in a trace maintain a unique ID for the span in the trace.span_id column.
BubbleUp dimension with nominal values that show a value occurred 1 time in the baseline and 0 times in the selection
Click on a value, or a pair of bars, to display an action menu to take further actions. For charts in the Dimensions section, this actions menu appears:
BubbleUp dimension bar chart value action menu when clicked
Group by Field : Adds a GROUP BY <field> clause and re-runs the query. Select Results to view a summary of grouped fields below the heatmap. Show only where field is value : Adds a WHERE clause to filter with <field> = <value> and re-runs the query. Show only where field is not value : Adds a WHERE clause to filter with <field> != <value> and re-runs the query. Copy field name : Copies the field name to your OS clipboard. For charts in the Measures section, this actions menu appears:
BubbleUp measures histogram chart value action menu when clicked
Show only where field less than : Adds a WHERE clause to filter with <field> < <value> and re-runs the query. Show only where field greater than : Adds a WHERE clause to filter with <field> > <value> and re-runs the query.

​
Correlations

The Correlations view consists of a dropdown window that displays the selected data source, a Filter search box, and up to the first six saved queries from the selected data source.
Screenshot showing the **Correlations** view display with a Service Health board selected and a filter of service.name=frontend
Each query contains one or more chart visualization(s) and a Show Query Details icon (). Hover over the Show Query Details icon () to reveal the query’s name and composition, and an option to open the query in a new tab. Selecting anywhere in the expanded query details opens the query in a new tab.
Screenshot showing display with query name, link to Open Query in new tab, and query details

​
Traces

The Traces view displays up to 10 traces with the slowest spans that match your query’s filters.
Click to a trace.

​
Explore Data

The Explore Data view shows the raw data from the current query, which ignores the query’s aggregates, any GROUP BY fields, and any ORDER BY fields.

​
Events View

Your data starts with the most recent events that occurred from the timestamp of the point you selected. At any time, you can choose to display your data either as a table display or as a log lines display.

​
Table Display

To display events data in a table, select the Show Table icon ().
Each column represents a field from your dataset. Each row represents an event with associated values. Expanding a row displays all of the event’s fields and their corresponding values.
Query Builder with Explore Data view selected and table display

​
Log Lines Display

To display events data in log lines, select the Show Log Lines icon () icon.
Each line represents an event, along with the values associated with the fields from your dataset. Expanding a line displays all of the event’s fields and their corresponding values. Where applicable, events are color-coded to match their corresponding standard severity level:
  • Red: error
  • Yellow: warn
  • Light blue: info
  • Dark blue: debug
  • Light gray: unspecified
  • Dark gray: No severity set
Color-coding relies on a source field being mapped to the Logs: Severity dataset field when you map your data. In addition, if you are using non-standard severities, use Calculated Fields to parse your severity values into Honeycomb standard severity values.
Query Builder with Explore Data view selected and log lines display
To wrap long log lines, press [w] on your keyboard or select Line wrap log lines from the display settings.

​
Fields List

On the left side of the Explore Data view, the fields list displays fields with data for this query. This list does not show all fields in the dataset. If a field is not visible, then spans in the query results have no data for that field. Use the Field Search box to search for a particular field name within the fields list. To expand the list and view all fields, scroll down the fields list and select Load More below the Displayed Fields list.

​
Filter Fields

To control which fields are visible in the table, select the Add icon () to the right of each field in the list of fields. Only the selected fields appears in the Explore Data table. A summary at the top of the fields list displays all selected fields under the Displayed fields section. To reorder fields in the table, select the Drag icon () and drag each field to the desired position.
Fields list display with three selected fields in the displayed fields section.

​
Download Your Data

To download your data:
  1. In the Events view, locate and select the Download options icon ().
  2. In the Export data modal, choose the fields to include in your download. Use the Export displayed fields only toggle to export all event fields [off] or export only fields displayed in the Events view [on].
  3. Choose the file format that you would like to download:
    • CSV: Download Events data in comma-separated values format in a .csv text file.
    • JSON Download Events data in JSON format in a .json text file.
Download menu with Export displayed fields only toggled on and options for CSV and JSON downloads
You can download a maximum of 1000 rows.

​
Search Within Results

The Explore Data search feature is in beta.Your feedback can help us improve this feature! Share feedback in Pollinators or through your account team.
Enter a string in the search bar to highlight occurrences of your search term within the query results. Honeycomb will search each field for your search term, display the total number of matches found, and highlight matches in both your query results and the fields list. For every field that matches your search term, Honeycomb may highlight:
  • a field value that matches, in the table display. For example, given the search term logs, Honeycomb would highlight the field value honeycomb-logs in the table display, regardless of field name.
  • a field name that matches, in the fields list. For example, given the search term logs, Honeycomb would highlight the field name logs_ingest_sli, regardless of field value.
  • a field name, in the fields list, that has a corresponding field value that matches. For example, given the search term logs, Honeycomb would highlight the field name app.dataset.name in the fields list if the field had a value of honeycomb-logs.
Scenario: You run a simple COUNT query that returns all events that were captured in the last two hours. You want to search through the returned events to find occurrences of the term error.Solution: Enter your search term, error, in the search bar, and execute your search.Honeycomb highlights the word error anywhere it is found in your query results, and displays the total number of matches found. If matches are found, Honeycomb will highlight:
  • field values that contain error, in the table display
  • field names that contain error, in the fields list
  • field names, in the fields list, that have a corresponding field value that contains error
Results returned in the Explore Data view for the search term 'error'. The total number of matches found is displayed near the search bar, and each occurrence of the word 'error' is highlighted in the table display and the fields list. Field names that do not contain the word 'error' may also be highlighted in the fields list, but only if the corresponding field value contains the word 'error'.
To clear highlighted areas, cancel out of your search by selecting x in the search bar.

​
Limitations

The Explore Data search function:
  • Accepts only string arguments
  • Excludes calculated field field names and values

​
Page Through Results

To page through your data, use the arrow buttons located above and to the right of the Explore Data view data table. To adjust the number of events displayed per page, use the dropdown window next to the arrow buttons.
Load more rows button at bottom of table

​
Customize Event Formatting

To customize event formatting, select the Display settings icon () in the top-right corner of the Events table, and then select the target toggle: Format events : Displays all fields in a line [off] or one field per line [on]. Highlight full event : Displays all field names and values in expanded events in black [off] or enables syntax highlighting [on]. Line wrap log lines : In the log lines display, allows text to extend beyond the visible area [off] or wraps text to the next line [on].
Event View Display Settings menu with the 'Format events' option selected, the 'Highlight full event' option selected, and the 'Line wrap log lines' option deselected.

​
Interact with Expanded Events

When you select a field within an expanded event, this action menu appears: Remove column from table : Removes field from displayed fields in Explore Data view. Show only where field exists : Adds a WHERE clause to filter with <field> exists and re-runs the query. Show only where field does not exist : Adds a WHERE clause to filter with <field> does-not-exist and re-runs the query. Show only where field is value : Adds a WHERE clause to filter with <field> = <value> and re-runs the query. Show only where field is not value : Adds a WHERE clause to filter with <field> != <value> and re-runs the query. Group by field : Adds a GROUP BY clause with <field> and re-runs the query. Copy field name : Copies the field name to your OS clipboard. Copy value : Copies the value name to your OS clipboard.
Events Column action menu with eight menu options listed.

​
View Tracing Details

If your dataset is a tracing dataset, then the trace.trace_id column displays trace ID fields as hyperlinks. Select any trace ID hyperlink to display the trace waterfall view, which contains the span represented by that row.
Tracing link example