make_graph
Folds parent-linked rows into a `dynamic` `{nodes, edges}` graph: one node per `id` and an edge `parent_id -> id`.
Use it for spans
(span_id/parent_span_id), process events (pid/ppid), or anything with
an id→parent relationship. Entry nodes are the ones with no inbound edge; roots
are not stored.
After id, parent_id, and time, pass inline name, value pairs — each
becomes a per-node attribute (recorded verbatim; no aggregation happens here,
since ids are unique). count (=1) and time are intrinsic. Attribute names
are string literals; values are per-row expressions, e.g.
make_graph(span_id, parent_span_id, start_time, "service", resource.service.name, "errors", status_code == "ERROR").
Collapse the graph by an attribute (a service dependency graph, a process tree)
with summarize_graph; union per-group graphs with merge_graphs. Those steps
are where aggregation functions are specified. (bzrk extension)
Syntax
make_graph(id, parent_id, time)Parameters
Prop
Type
Returns: dynamic
Syntax
make_graph(id, parent_id, time, attr)Parameters
Prop
Type
Returns: dynamic
Examples
Example 1
spans
| summarize g = make_graph(
span_id,
parent_span_id,
start_time,
"service",
resource.service.name,
"errors",
status_code == "ERROR",
"duration",
duration,
"name",
span_name
)
by trace_id| trace_id (dynamic) | g (dynamic) |
|---|---|
| "aaaa1111aaaa1111aaaa1111aaaa1111" | {"edges":[{"count":1,"from":"0000000000000001","time":1704103200000000000,"to":"0000000000000005"},{"count":1,"from":"0000000000000001","time":1704103201000000000,"to":"0000000000000002"},{"count":1,"from":"0000000000000002","time":1704103201000000000,"to":"0000000000000003"},{"count":1,"from":"0000000000000003","time":1704103202000000000,"to":"0000000000000004"}],"nodes":[{"attrs":{"duration":00:00:00.1500000,"errors":false},"count":1,"id":"0000000000000001","time":1704103200000000000},{"attrs":{"duration":00:00:00.0100000,"errors":false},"count":1,"id":"0000000000000005","time":1704103200000000000},{"attrs":{"duration":00:00:00.1200000,"errors":false},"count":1,"id":"0000000000000002","time":1704103201000000000},{"attrs":{"duration":00:00:00.1000000,"errors":false},"count":1,"id":"0000000000000003","time":1704103201000000000},{"attrs":{"duration":00:00:00.0500000,"errors":false},"count":1,"id":"0000000000000004","time":1704103202000000000}]} |
| "bbbb2222bbbb2222bbbb2222bbbb2222" | {"edges":[{"count":1,"from":"0000000000000006","time":1704103261000000000,"to":"0000000000000007"}],"nodes":[{"attrs":{"duration":00:00:00.2000000,"errors":false},"count":1,"id":"0000000000000006","time":1704103260000000000},{"attrs":{"duration":00:00:00.1800000,"errors":false},"count":1,"id":"0000000000000007","time":1704103261000000000}]} |
| "cccc3333cccc3333cccc3333cccc3333" | {"edges":[{"count":1,"from":"0000000000000008","time":1704103321000000000,"to":"0000000000000009"}],"nodes":[{"attrs":{"duration":00:00:00.0800000,"errors":false},"count":1,"id":"0000000000000008","time":1704103320000000000},{"attrs":{"duration":00:00:00.0500000,"errors":false},"count":1,"id":"0000000000000009","time":1704103321000000000}]} |
topk
Returns the `K` keys with the largest summed weight within each group, as a dynamic array of property bags ordered by weight descending.
merge_graphs
Unions canonical `{nodes, edges}` graphs (produced by `make_graph` or `summarize_graph`) into one, aggregating same-id nodes and same-`(from, to)` edges.