find-traces

# Trace Analysis

Analyze OpenTelemetry distributed traces to identify errors, latency issues, and root causes.

## Arguments

When invoked with a trace ID (e.g., `/find-traces abc123...`), it's available as `$ARGUMENTS`.

## Trace Dataset Discovery

First, find trace datasets:

```bash
axiom dataset list -f json
```

Look for datasets containing trace data (often named `*traces*`, `*spans*`, or `otel-*`).

## Schema Discovery

**Always verify field names first:**

```bash
axiom query "['<trace-dataset>'] | getschema" --start-time -1h
```

## Common Operations

### Get Trace by ID

```bash
axiom query "['<dataset>']
| where trace_id == '<TRACE_ID>'
| sort by _time asc
| limit 100" --start-time -1h -f json
```

### Find Error Traces

```bash
axiom query "['<dataset>']
| where _time >= ago(1h)
| where error == true
| extend error = coalesce(ensure_field(\"error\", typeof(bool)), false)
| summarize
    start_time = min(_time),
    total_duration = max(duration),
    span_count = count(),
    error_count = countif(error),
    services = make_set(['service.name']),
    root_operation = arg_min(_time, name)
  by trace_id
| sort by start_time desc
| limit 20" --start-time -1h -f json
```

### Find Slow Traces

```bash
axiom query "['<dataset>']
| where _time >= ago(1h)
| where duration >= 1000000000
| summarize
    start_time = min(_time),
    total_duration = max(duration),
    span_count = count(),
    services = make_set(['service.name'])
  by trace_id
| sort by total_duration desc
| limit 20" --start-time -1h -f json
```

### Find Traces by Service

```bash
axiom query "['<dataset>']
| where _time >= ago(1h)
| where ['service.name'] == '<SERVICE>'
| summarize
    start_time = min(_time),
    total_duration = max(duration),
    span_count = count(),
    error_count = countif(error == true)
  by trace_id
| sort by start_time desc
| limit 20" --start-time -1h -f json
```

### Error Spans in Trace

```bash
axiom query "['<dataset>']
| where trace_id == '<TRACE_ID>'
| where