SQL Editor

SELECT name, input, output, start_time
FROM spans
WHERE start_time > now() - INTERVAL 3 DAY

-- Slow: scans everything
SELECT * FROM spans WHERE trace_id = 'abc-123'

-- Fast: scans only relevant time range
SELECT * FROM spans 
WHERE trace_id = 'abc-123'
  AND start_time > now() - INTERVAL 1 DAY

-- First: find the spans you care about
SELECT trace_id, name, input, output
FROM spans
WHERE span_type = 'LLM' AND start_time > now() - INTERVAL 1 DAY

-- Second: get trace-level data for those trace_ids
SELECT id, duration
FROM traces
WHERE id IN ('id1', 'id2', 'id3')

-- Spans per day over the last month
SELECT
    toStartOfInterval(start_time, INTERVAL 1 DAY) AS day,
    count(*) AS span_count
FROM spans
WHERE start_time > now() - INTERVAL 1 MONTH
GROUP BY day
ORDER BY day

-- Extract token counts from LLM spans
SELECT
    name,
    simpleJSONExtractInt(attributes, 'gen_ai.usage.input_tokens') AS input_tokens,
    simpleJSONExtractInt(attributes, 'gen_ai.usage.output_tokens') AS output_tokens
FROM spans
WHERE span_type = 'LLM' AND start_time > now() - INTERVAL 1 DAY

SELECT count(*)
FROM spans
WHERE simpleJSONHas(attributes, 'gen_ai.request.structured_output_schema')

-- Extract event names from spans
SELECT 
    span_id,
    arrayMap(e -> tupleElement(e, 'name'), events) as event_names
FROM spans
WHERE length(events) > 0
  AND start_time > now() - INTERVAL 1 DAY
LIMIT 10

-- Find spans with cache_hit events
SELECT span_id, name, events
FROM spans
WHERE arrayExists(e -> tupleElement(e, 'name') = 'cache_hit', events)
  AND start_time > now() - INTERVAL 1 DAY

-- Get one row per span in each evaluation datapoint
SELECT 
    edp.id as datapoint_id,
    tupleElement(span, 'name') as span_name,
    tupleElement(span, 'duration') as span_duration,
    tupleElement(span, 'type') as span_type
FROM evaluation_datapoints edp
ARRAY JOIN edp.trace_spans as span
WHERE edp.evaluation_id = 'your-evaluation-id'
LIMIT 100

-- Convert event timestamps from nanoseconds to DateTime
SELECT 
    span_id,
    arrayMap(e -> toDateTime64(tupleElement(e, 'timestamp') / 1e9, 9, 'UTC'), events) as event_times
FROM spans
WHERE length(events) > 0
  AND start_time > now() - INTERVAL 1 DAY
LIMIT 10

DEFAULT
LLM
EXECUTOR
EVALUATOR
EVALUATION
TOOL
HUMAN_EVALUATOR
CACHED
UNKNOWN

-- Find spans with a specific tag
SELECT name, tags
FROM spans
WHERE has(tags, 'needs-review')
  AND start_time > now() - INTERVAL 1 DAY

-- Convert event timestamps to DateTime
SELECT 
    span_id,
    arrayMap(t -> toDateTime64(t / 1e9, 9, 'UTC'), tupleElement(events, 'timestamp')) as event_timestamps
FROM spans
WHERE length(events) > 0
  AND start_time > now() - INTERVAL 1 DAY

-- Find spans with specific event names
SELECT span_id, name, events
FROM spans
WHERE arrayExists(e -> tupleElement(e, 'name') = 'cache_hit', events)
  AND start_time > now() - INTERVAL 1 DAY

-- Unnest events to get one row per event
SELECT 
    span_id,
    name as span_name,
    toDateTime64(tupleElement(event, 'timestamp') / 1e9, 9, 'UTC') as event_time,
    tupleElement(event, 'name') as event_name,
    tupleElement(event, 'attributes') as event_attributes
FROM spans
ARRAY JOIN events as event
WHERE start_time > now() - INTERVAL 1 DAY
LIMIT 100

DEFAULT
EVALUATION
PLAYGROUND

SELECT
    model,
    sum(total_cost) AS total_cost,
    count(*) AS call_count
FROM spans
WHERE span_type = 'LLM' AND start_time > now() - INTERVAL 7 DAY
GROUP BY model
ORDER BY total_cost DESC

SELECT name, avg(end_time - start_time) AS avg_duration_ms
FROM spans
WHERE start_time > now() - INTERVAL 1 DAY
GROUP BY name
ORDER BY avg_duration_ms DESC
LIMIT 10

SELECT
    name,
    countIf(status = 'error') AS errors,
    count(*) AS total,
    round(errors / total * 100, 2) AS error_rate
FROM spans
WHERE start_time > now() - INTERVAL 1 DAY
GROUP BY name
HAVING total > 10
ORDER BY error_rate DESC

SELECT 
    span_id, 
    name, 
    tags, 
    start_time
FROM spans
WHERE has(tags, 'needs-review')
  AND start_time > now() - INTERVAL 7 DAY
ORDER BY start_time DESC
LIMIT 100

SELECT 
    tupleElement(event, 'name') as event_name,
    count(*) as event_count
FROM spans
ARRAY JOIN events as event
WHERE start_time > now() - INTERVAL 1 DAY
GROUP BY event_name
ORDER BY event_count DESC

SELECT 
    countIf(arrayExists(e -> tupleElement(e, 'name') = 'cache_hit', events)) as cache_hits,
    count(*) as total_spans,
    round(cache_hits / total_spans * 100, 2) as cache_hit_rate
FROM spans
WHERE span_type = 'LLM'
  AND start_time > now() - INTERVAL 1 DAY

SELECT 
    evaluation_id,
    avg(total_cost) as avg_cost,
    avg(duration) as avg_duration_seconds,
    count(*) as datapoint_count
FROM evaluation_datapoints
WHERE evaluation_id = {evaluation_id:UUID}
GROUP BY evaluation_id

SELECT 
    id,
    group_id,
    scores,
    trace_spans
FROM evaluation_datapoints
WHERE arrayExists(s -> tupleElement(s, 'type') = 'LLM', trace_spans)
  AND evaluation_id = {evaluation_id:UUID}
LIMIT 100

SELECT 
    tupleElement(span, 'type') as span_type,
    count(*) as span_count,
    avg(tupleElement(span, 'duration')) as avg_duration
FROM evaluation_datapoints
ARRAY JOIN trace_spans as span
WHERE evaluation_id = {evaluation_id:UUID}
GROUP BY span_type
ORDER BY span_count DESC