--- title: "Explorer" slug: "explorer" description: "The Traceable Explorer is a centralized API monitoring tool designed for real-time analysis of API behavior, security, and performance. It provides in-depth visibility into API activity through endpoint traces, spans, and events, enabling precise tracking of API requests across services. With customizable filters, visualizations, and query management options in the Recent and Saved tabs, Traceable Explorer streamlines API data analysis, supporting proactive security and operational insights." updated: 2026-02-26T05:26:25Z published: 2026-02-26T05:26:25Z --- > ## Documentation Index > Fetch the complete documentation index at: https://traceabledocs.document360.io/llms.txt > Use this file to discover all available pages before exploring further. # Explorer The **Explore Data** page in Traceable acts as a centralized dashboard for monitoring and analyzing API activity, providing an overarching view of how requests interact with your application system. It categorizes data into endpoint traces, spans, and events, providing a detailed understanding of API behavior. While endpoint traces provide information about the process of individual requests at each API endpoint, spans provide the building blocks of a trace. Events provide additional detail by highlighting specific, significant occurrences of threats within spans, such as security checks or errors, and include context like timestamps and service details. ![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_analytics_explorer_tab(1).png) Explorer The Explore Data page contains the following tabs: - [Explorer](/v1/docs/explorer#explorer) — The **Explorer** tab shows data for endpoint traces, spans, and events. The tab also displays **Visualizations**, allowing you to select and customize parameters, such as metrics and aggregation types, to gain a deeper understanding of data trends. The **Results** table in the tab shows an interactive view of traces, spans, and events with options to expand each row for detailed information. The **Filters** enable targeted searches, and you can save complex or frequently used queries for quick access through the save queries option. - [Recent](/v1/docs/explorer#recent) — The **Recent** tab maintains a log of executed queries, categorizing them as in-queue or completed, and allows you to track their statuses, further streamlining query management and tracking. - [Saved](/v1/docs/explorer#saved) — The **Saved** tab shows queries that you wish to reuse, enabling you to quickly access, edit, or share these saved queries with team members. Using the above tabs and functionalities, the Explore Data page provides efficient monitoring and in-depth analysis of API security, performance, and activity data. The following sections provide a detailed explanation of each tab. --- ## Explorer The Explorer tab contains the following sub-tabs: ![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_explorer_details(1).png) - **Endpoint Traces** — Traces are records of the lifecycle of a request as it navigates through various components or services of your application ecosystem. Endpoint traces are a sub-segment of the trace that provides detailed information about the activities of an API endpoint. - **Spans** — Spans are individual components that together build up a trace. They represent a specific function call within a request lifecycle. - **Events** — Events are specific time periods within a span during which Traceable observed threats in an API request. They capture details about the operation within a span, such as errors, the service in which they occur, and the timestamp. The data in the above tabs is shown for the *Last 1 day* across *All Environments*, by default. However, you can customize the time range and environments according to your requirements, from the tab’s top right corner. You can also visualize the data shown in these sub-tabs based on various metrics. For more information on visualizing this data, see [Visualization](/v1/docs/explorer#visualization). The Traceable platform receives raw span data from its agent. Traceable's business logic creates the trace and the Endpoint trace from these spans and events. The Explorer tab also provides the capability to view raw span and event data. Traceable identifies all request and response data in an API request, such as request headers, body, cookies, etc., and captures them as individual span attributes and events. This data is presented in a table under the [Results](/v1/docs/explorer#results) section. You can also apply one or more filters or conditions to narrow down the search and run the query according to your requirements. If a filter has an associated operation, it is shown when you enter a space in the search bar. For more information on the filters and associated operators, see [Filters](/v1/docs/explorer#filters). ### Query Processing Once you run the query, Traceable inspects the query parameters, like time range, filters, attributes, etc., and dynamically processes it using either of the following methods: > [!NOTE] > Note > > These methods are applicable only in the **Endpoint Traces** and **Spans** tab. ##### **Using the real-time OLAP store** Traceable, upon receiving the query, synchronously executes it in the OLAP store and shows the result in the page within a 30-second timeout. ##### **Using the data lake** For queries processed using the data lake, Traceable shows a dialogue box on the Explore Data page while executing the query in the background. In this box, you can either click **Cancel Request** to abort the query execution or click **Ok**, after****which Traceable redirects you to the [Recent](/v1/docs/explorer#recent) tab, where you can monitor the progress of the query. ![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_explorer_long_running_queries.png) You can also navigate away from the page while Traceable is processing the query. Once the query execution is complete, Traceable displays a notification in the bottom-right corner of the page with the option to **View Results**. Upon clicking, you are redirected to the **Explorer** tab in the **Explore Data** page, where you can view the results. ![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_explorer_view_results(1).png) Based on the query execution and result, you can also create custom rate-limiting policies according to your requirements. To create the policy, click **+ Create Policy** above the search bar. While Traceable pre-fills the configurations based on your filters, you can customize them according to your requirements. For more information on these policies, see [Custom Policy](/docs/custom-policy). The following sections explain the various components displayed in the **Explorer** tab. ### Visualization The Visualization section displays a chart that you can use for analysis and data visualization. You can also customize this chart according to your requirements by doing either of the following: - Add or remove metrics and aggregations > [!NOTE] > Note > > You must add at least one metric for the visualization to appear. - Modify the type of visualization - Select the interval for which you wish to view the data - Select the parameter based on which you wish to group the data. - Select the parameter based on which you wish to order the visualization. Once you have customized the visualization, you can hover over it to view the required details. The following demo illustrates how to create a visualization that displays the *Call* *Rate (sec)* metric, grouped by *Endpoint Name*, with a maximum of *10* groups in the chart and an interval of *None*. The visualization is also ordered by the descending number of calls. When you hover the mouse over the columns, a pop-up shows the call rate for all 10 endpoints. Similarly, you can create several visualizations to compare various parameters. [Embedded content](https://demo.arcade.software/77QMw0LujbCQr4g5WMxd) ### Results The Results section contains a table that lists the traces, spans, or events for the selected time range and environment. Each list item contains detailed information about it. To view the information, expand the item by clicking the **>** icon corresponding to a row. Upon expanding, depending on the tab, you can also create label rules or custom policies according to your business requirements. For more information on creating them, see [Label Management](/docs/label-management) and [Custom Policy](/docs/custom-policy). In addition to the above actions, you can click a column name to do the following: - **Sort Ascending** — Use this option to sort the data shown on the page in ascending order. - **Sort Descending** — Use this option to sort the data shown on the page in descending order. - **Add as a filter** — Use this option to refine the data shown on the page. Upon clicking, a pop-up window is shown with the values from which you can select. - **Hide in view** — Use this option to hide the column from the page. - **Edit Columns** — Use this option to add or remove columns according to your requirements. You can also download the desired number of results by clicking the **Menu** (![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_menu_icon.png)) icon → **Download as CSV** in the section’s top right corner. ### Filters Traceable allows you to add one or more filters according to your requirements. To add the filters, complete the following steps: ![Traceable _ Explorer _ Filters(1)](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable%20_%20Explorer%20_%20Filters(1).gif) Explorer Filters 1. Click the search bar at the top of the page and specify the parameter. For commonly used filters across Endpoint Traces and Spans, see [Filter Parameters](/docs/explorer-parameters-and-operators#filter-parameters). 2. Add a space after the parameter and add the operator. For descriptions and examples, see [Operators](/docs/explorer-parameters-and-operators#operators). 3. Specify the values corresponding to the parameter and operator. 4. Click **Enter** or **return** and click **Run**. > [!NOTE] > Note > > - Traceable applies an *AND* operation across all selected filters. > - Currently, Traceable does not support *OR* conditions or grouped filters such as `(A OR B) AND C`. You can also auto-fill filters by hovering over a value in any column and clicking the **Filter**(![traceable_filter_icon(1)](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_filter_icon(1).png)) icon corresponding to it. Upon clicking, Traceable displays a list having the same column name and value, but different operators. You can choose the list item having the operator that you wish to apply. For example, if you wish to view data for services with *frontend* as the name, then you can select *Service Name = frontend*. Similarly, you can apply multiple auto-fill filters according to your requirements. The following demo demonstrates how to add auto-fill filters. ![Traceable _ Explorer _ Auto-fill Filters](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/Traceable%20_%20Explorer%20_%20Auto-fill%20Filters.gif) Auto-fill Filters Once you have applied the necessary filters, you can save the queries for later use. For more information on saving queries, see the section below. ### Save Queries Traceable provides you with an option to save your queries for future use. Saving queries can help you save time if you wish to reuse the same query. When saving a query, you can select the time range for which you want to save the query. Traceable provides the following options for selecting the time range: - **Application Time Range** — This is equivalent to not choosing any time range. - **Last 1 day** — This time range is the same as the one you chose from the time-range drop-down at the top of the tab. In the demo shown below, it is**the*Last 1 day*. The time range changes if you select a different option from the drop-down menu at the top of the page. When you select this option, the query result is based on the saved time range that you specified. This means that if the application time range is 1 week and the saved query time range is 1 day, then the result will be based on the data from the last 1 day. - **Exact time** — This option saves the query for the time when it was last run. For example, in the demo below, the query is run for *04/11/2024, 19:23:51 - 05/11/2024, 19:23:51*. When you save the query with this time range, it will always show the result between 4th and 5th November. > [!NOTE] > Note > > The *Exact Time* range query result is available only for three days. If the selected time range lies outside of this period, the saved query does not show any result. The following demo demonstrates how you can save a query: [Embedded content](https://demo.arcade.software/vpid3QMAFIcgm6k4l5aC) You can view the saved queries in either of the following ways: - From the **Saved** tab. For more information, see [Saved](/v1/docs/explorer#saved). - By clicking the **Filter**(![traceable_filter_icon](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_filter_icon.png)) icon corresponding to the search bar and searching for the query using its name. You can also hover over the **File**(![traceable_catalog_compliance_policies_file_icon](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_catalog_compliance_policies_file_icon.png)) icon corresponding to a query to view its details. ![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_explorer_saved_queries.png) Traceable also provides you with the option to save queries from the **Recent** tab. For more information, see the section below. --- ## Recent The **Recent** tab displays the queries that you execute in the **Endpoint Traces** and **Spans** tabs under Explorer. The tab is divided into two parts, [Queries in Queue](/v1/docs/explorer#queries-in-queue) and [Completed Queries](/v1/docs/explorer#completed-queries). The following sections explain these parts. ![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_explorer_recent(1).png) Recent Tab #### Queries in Queue This section lists the queries currently in the queue or being processed. You may have run these queries in the **Explorer** tab and they may have required a longer time for execution (processing using the data-lake). The queries are executed simultaneously based on the availability of resources. For each query, Traceable displays basic details, including the time at which the query was run and a progress bar for it. You can also cancel the query execution while it is in progress by clicking the **X** icon corresponding to a row. #### Completed Queries This section lists the queries that have been completed. This includes queries that have succeeded or failed. The following details are shown for each query: - **Time of expiry** — The amount of time remaining for a query and its result to expire. Traceable stores a query for three days, after which it is deleted. If you wish to retain these queries, you can save them according to your requirements. - **Time Range** — The time range that you selected in the *Explorer* tab while running the query. - **Scope** — The tab under which you executed the query, for example, *Endpoint Traces* in the above screenshot. - **Filters** — The parameters based on which you applied filters for executing the query, for example, *Service Name like* (~)*service*. - **Metric Selections** — The number of metrics you selected for visualizing data shown as part of the result. For more information on these metrics, see [Visualization](/v1/docs/explorer#visualization). - **Results Selections** — The number of columns shown as part of the result, for example, *11* in the above screenshot. - **Run At** — The time at which you executed the query in the Explorer tab. - **Actions** — This column provides the option to rerun the query. You can click **Run** to reexecute the queries and fetch the results again. Upon clicking, you must select the time range for which you wish to execute the query. Traceable redirects you to the **Explorer** tab and displays the results. For queries processed using the data lake (long-running queries), Traceable provides you with the option to view **Previous Results**. Upon clicking, Traceable redirects you to the relevant section (Endpoint Traces or Spans) and displays the results for the specified time range used during query execution. For example, if you executed the query for the *27/10/2024, 19:23:51 - 28/10/2024, 19:23:51* time range, then Traceable shows the results for the same time range. Traceable also allows you to filter data shown in this section based on the query state (succeeded or failed). To do so, you can click the **Filter** (![traceable_filter_icon](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_filter_icon.png)) icon above the section, as shown in the above screenshot. ##### Additional Actions You can click the **Ellipse** (![traceable_ellipse_icon](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_ellipse_icon.png)) icon corresponding to a query and perform the following actions: - **Copy Link** — This option enables you to share the query results with your team members added to the Traceable platform. The team members are redirected to the **Explorer** tab, which displays the result of the query. - **Save Query** — This option enables you to save the query for later use. The query is stored indefinitely. You can navigate to the **Saved** tab and execute the query according to your requirements. While saving the query, you can specify a name for the query, the time range for which you wish to execute the query in the future, and comments. For more information on Saved queries, see [Saved](/v1/docs/explorer#saved). - **Delete** — This option allows you to permanently delete the query. > [!NOTE] > Note > > A deleted query cannot be restored. --- ## Saved Traceable provides some pre-saved queries out of the box that are most frequently used. You can execute these queries on the **Endpoint Traces** from the **Saved** tab and view the relevant results. You can also edit these queries to modify the name, time range for which they are executed, and add comments. ![](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_explorer_saved.png) Saved Tab Apart from the pre-saved queries, the page also lists the queries that you may have saved from the **Explorer** or **Recent** tab. The following columns are shown on the page: - **Query** — This column shows the query name that you specified while saving the query. It also displays the scope of the query, which corresponds to the tab under which the query was executed, such as Endpoint Traces, Spans, or Events. You can also hover over the **File** icon corresponding to a query to view the configured details for that query. - **Owner** — This column shows the team member's name who saved the query. The queries provided out of the box are labeled with Traceable as the owner. You can click **Run** corresponding to each query and execute it according to your required time range. You can also click the **Ellipse** (![traceable_ellipse_icon](https://cdn.document360.io/24f14f07-13d1-4684-8fae-6d8f811768ee/Images/Documentation/traceable_ellipse_icon.png)) icon corresponding to a query and perform the following actions: - **Copy Link** — This option enables you to share the query results with your team members added to the Traceable platform. The team members are redirected to the **Explorer** tab, where the query results are displayed. - **Edit** — This option allows you to edit the query name, the time range for which you want to execute the query, and add comments. - **Delete** — This option allows you to permanently delete the query. > [!NOTE] > Note > > A deleted query cannot be restored. --- ## Pattern Matching Using Regular Expressions (RE) Traceable Explorer supports regular expression (RE)-based pattern matching, allowing you to search trace payloads for patterns instead of exact values. This is especially useful for working with nested JSON payloads or when sensitive data is dynamic. The underlying query engine uses the `regexp_like` function. > [!NOTE] > **Note** > > - Escape backslashes in patterns: use `\\d` instead of `\d`. > - Explorer supports only RE2-compliant regular expressions. Lookaheads, lookbehinds, and backreferences are not supported. **Syntax:** ```sql regexp_like(string, pattern) ``` - `string`: The payload (or field) to evaluate. - `pattern`: A Java-compatible regular expression pattern. ### Example Use Cases #### 1. Match a Specific Pattern Inside a Deeply Nested JSON Payload This use case demonstrates how to match values deeply nested within structured API payloads, a common pattern in real-world applications where user details or identifiers are embedded several levels down. **Query:** ```sql regexp_like(payload, '\"identity_number\"\s*:\s*\"\d{12}\"') ``` **Sample Payload:** ```json {  "session": {    "timestamp": "2025-05-06T09:00:00Z",    "request": {      "metadata": {        "source": "web",        "tracking": {          "visitor": {            "identity_number": "234512341234",            "region": "US-West"          }        }      }    }  },  "event": "user_registration" } ``` This matches the deeply nested identity number `"identity_number": "234512341234"` inside the `session.request.metadata.tracking.visitor` structure. **Regex breakdown:**** - `\"identity_number\"` – Matches the key name exactly. - `\s*:\s*` – Matches the colon between key and value with optional spaces. - `\"\d{12}\"` – Matches exactly 12 digits inside quotes. #### 2. Detect Email Addresses in Payloads **Query:** ```sql regexp_like(payload, '\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b') ``` **Sample Payload:** ```json {  "user": {    "name": "Jane Doe",    "email": "hacker@somecompany.com"  },  "action": "login" } ``` This will match the string `"hacker@somecompany.com"`. **Regex breakdown:** - `\\b` – Word boundary to ensure the match starts cleanly. - `[A-Za-z0-9._%+-]+` – Matches the email’s local part (e.g., `hacker`). - `@` – Literal at symbol. - `[A-Za-z0-9.-]+` – Matches the domain part (e.g., `somecompany.com`). - `\\.` – Literal dot. - `[A-Z|a-z]{2,}` – Matches domain extensions like `.com`, `.org`. - `\\b` – Word boundary to ensure the match ends cleanly. #### 3. Identify Credit Card Number Patterns **Query:** ```sql regexp_like(payload, '\\b(?:\\d[ -]*?){13,16}\\b') ``` **Sample Payload:** ```json {  "payment": {    "card_number": "4111 1111 1111 1111",    "expiry": "04/26"  },  "status": "processing" } ``` This matches the credit card number `4111 1111 1111 1111`. **Regex breakdown:** - `\\b` – Word boundary to isolate the number. - `(?:\\d[ -]*?){13,16}` – Non-capturing group that matches 13 to 16 digits, optionally separated by spaces or hyphens. - `\\b` – Word boundary to finish the match. #### 4. Search for Authorization Headers with Bearer Tokens **Query:** ```sql regexp_like(payload, 'Authorization:\\s*Bearer\\s+[A-Za-z0-9\\-._~+/]+=*') ``` **Sample Payload:** ```json {  "headers": {    "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"  },  "request": {    "endpoint": "/user/info"  } } ``` This matches the entire Bearer token string in the `Authorization` header. **Regex breakdown:** - `Authorization:` – Matches the literal header key. - `\\s*Bearer\\s+` – Matches the word "Bearer" with optional whitespace before and required whitespace after. - `[A-Za-z0-9\\-._~+/]+=*` – Matches the token itself, allowing base64 characters and optional trailing `=` for padding. --- ### Example: Detecting PII Fields in a Nested JSON Payload The following is a sample payload ```json {  "user": {    "profile": {      "fullName": "Jane Doe",      "contacts": {        "email": "jane.doe@example.com",        "phone": "+1-555-123-4567"      },      "identifiers": {        "ssn": "987-65-4320",        "passport": {          "number": "A1234567",          "country": "USA"        }      }    },    "session": {      "ip": "192.168.1.5",      "device": {        "type": "mobile",        "id": "device-xyz-9876"      }    }  },  "order": {    "items": [      { "id": "item-001", "name": "Laptop", "price": 1200 },      { "id": "item-002", "name": "Mouse", "price": 50 }    ],    "payment": {      "method": "credit_card",      "cardDetails": {        "cardNumber": "4111 1111 1111 1111",        "expiry": "12/26"      }    }  } } ``` #### Regex Query to Detect PII Keys and Values ```plaintext (?i)("?(ssn|card(number)?|email|phone|passport)"?\s*:\s*"?[^\s",]+"?) ``` #### What it Matches: This regex will match any of the following fields and their values: - `"email": "jane.doe@example.com"` - `"phone": "+1-555-123-4567"` - `"ssn": "987-65-4320"` - `"cardNumber": "4111 1111 1111 1111"` - `"passport": { "number": "A1234567", ... }` (will match the `"passport"` key, though not deeply into nested object values unless parsed separately) --- ### Combining RE with Standard Filters You can combine RE queries with other standard filters in the Explorer's search bar. **Example:** ```sql Service Name = app-dev AND regexp_like(payload, '\"identity_number\"\\s*:\\s*\"\\d{12}\"') ``` **What this does:** - Filters traces for the service name `app-dev`. - Then applies regex to find payloads that contain a 12-digit `identity_number` in nested JSON. > [!NOTE] > **Note** > > Enter this combined query in the search bar at the top of the Explorer page, then click **Run** to execute it. For more information on different operators and paramteres, see [Parameters and Operators](/docs/explorer-parameters-and-operators). --- ### Recommendations - Combine RE filters with other filters (e.g., endpoint, user ID, error code) for deeper analysis. - Regular expressions are **case-sensitive** by default. - Ensure that your regular expression patterns are RE2-compliant. - See more examples and syntax support in the [Trino regex documentation](https://trino.io/docs/current/functions/regexp.html).