Cross-signal correlation follows one problem across signals: from a slow page to its backend trace,
from the trace to its logs, from a metric spike to the requests behind it. Each jump keeps the time
window and carries identifiers such as trace_id, the service, or the host, so nothing is copied by
hand. The jumps rely on stable fields; keep service.name, deployment.environment, trace_id, and
host.name intact during intake.
Where the jumps are
The investigation context bar
While an investigation is going on, a bar under the top bar shows it: the number of frames in the
stack, the locked time window, the key signals such as the trace ID, and the filters that ride along
from page to page.
The investigation stack in the UI
The investigation stack keeps the trail of a drill: each jump pushes a frame, and ⌘[ and ⌘] move
back and forward through it. The stack holds up to 6 frames; past that, the oldest unpinned frame is
dropped, and a pinned frame stays. ⌘⌥T and ⌘⌥L start a stack from a trace or a log search, and the
command palette opens a result in a new stack or on
top of the current one.
⌘⌥Y copies the address of the current page, with its time window and filters. Opening a copied link
still requires the permissions of every resource in it.
Correlation API
The UI computes each jump with one call, and scripts can do the same:
Given the context of a starting signal and a target signal, the endpoint returns the filters, the time
range, and a query prefill for the target page. It reads no telemetry, except for one lookup of a
neighboring service in the service graph. See Cross-signal correlation
for the supported jumps.
Related pages
Last modified on October 26, 2026
