make_graph
Folds parent-linked rows into a `dynamic` `{nodes, edges}` graph: one node per `id` and an edge `parent_id -> id`.
Use it for spans
(span_id/parent_span_id), process events (pid/ppid), or anything with
an id→parent relationship. Entry nodes are the ones with no inbound edge; roots
are not stored.
After id, parent_id, and time, pass inline name, value pairs — each
becomes a per-node attribute (recorded verbatim; no aggregation happens here,
since ids are unique). count (=1) and time are intrinsic. Attribute names
are string literals; values are per-row expressions, e.g.
make_graph(span_id, parent_span_id, start_time, "service", resource['service.name'], "errors", status_code == "ERROR").
Collapse the graph by an attribute (a service dependency graph, a process tree)
with summarize_graph; union per-group graphs with merge_graphs. Those steps
are where aggregation functions are specified.
If the collapsed graph is all you need, prefer make_graph_by: it does both
steps in one pass and holds a stub per row instead of the row, so it scales to
windows where this form exceeds the aggregate memory budget. (bzrk extension)
Syntax
make_graph(id, parent_id, time)Parameters
Prop
Type
Returns: dynamic
Syntax
make_graph(id, parent_id, time, attr)Parameters
Prop
Type
Returns: dynamic
Examples
Example 1
spans
| summarize g = make_graph(
span_id,
parent_span_id,
start_time,
"service",
resource['service.name'],
"errors",
status_code == "ERROR",
"duration",
duration,
"name",
span_name
)
by trace_id| trace_id (dynamic) | g (dynamic) |
|---|---|
| "aaaa1111aaaa1111aaaa1111aaaa1111" | {"edges":[{"count":1,"from":"0000000000000001","time":1704103200000000000,"to":"0000000000000005"},{"count":1,"from":"0000000000000001","time":1704103201000000000,"to":"0000000000000002"},{"count":1,"from":"0000000000000002","time":1704103201000000000,"to":"0000000000000003"},{"count":1,"from":"0000000000000003","time":1704103202000000000,"to":"0000000000000004"}],"nodes":[{"attrs":{"duration":00:00:00.1500000,"errors":false},"count":1,"id":"0000000000000001","time":1704103200000000000},{"attrs":{"duration":00:00:00.0100000,"errors":false},"count":1,"id":"0000000000000005","time":1704103200000000000},{"attrs":{"duration":00:00:00.1200000,"errors":false},"count":1,"id":"0000000000000002","time":1704103201000000000},{"attrs":{"duration":00:00:00.1000000,"errors":false},"count":1,"id":"0000000000000003","time":1704103201000000000},{"attrs":{"duration":00:00:00.0500000,"errors":false},"count":1,"id":"0000000000000004","time":1704103202000000000}]} |
| "bbbb2222bbbb2222bbbb2222bbbb2222" | {"edges":[{"count":1,"from":"0000000000000006","time":1704103261000000000,"to":"0000000000000007"}],"nodes":[{"attrs":{"duration":00:00:00.2000000,"errors":false},"count":1,"id":"0000000000000006","time":1704103260000000000},{"attrs":{"duration":00:00:00.1800000,"errors":false},"count":1,"id":"0000000000000007","time":1704103261000000000}]} |
| "cccc3333cccc3333cccc3333cccc3333" | {"edges":[{"count":1,"from":"0000000000000008","time":1704103321000000000,"to":"0000000000000009"}],"nodes":[{"attrs":{"duration":00:00:00.0800000,"errors":false},"count":1,"id":"0000000000000008","time":1704103320000000000},{"attrs":{"duration":00:00:00.0500000,"errors":false},"count":1,"id":"0000000000000009","time":1704103321000000000}]} |
topk
Returns the `K` keys with the largest summed weight within each group, as a dynamic array of property bags ordered by weight descending.
make_graph_by
Builds a **collapsed** `{nodes, edges}` graph directly from parent-linked rows: one node per distinct `key` value, and an edge for each row whose immediate parent carries a different `key`.