Intelligent Exemplar

When an alert fires for a latency spike or error surge, your first challenge is finding where the problem lives. Instead of keeping your investigative context, the standard workflow drops you into an unfiltered list of thousands of traces—forcing you to manually rebuild filters and scrub through data to find the one trace that shows the problem.

Intelligent Exemplar (IE) eliminates that search. It preserves the exact context from your click, algorithmically surfaces the traces that best represent the anomaly, and navigates you directly to the failing span — so you go from spike to root span in clicks instead of hours.

Once you've identified the failing span, use Attribute Correlation Analysis to answer why it's failing — by statistically comparing your anomalous traces against a healthy baseline and surfacing the specific attributes driving the issue.

How Intelligent Exemplar works

IE combines three behaviors to close the gap between a high-level metric and the exact code-level trace you need:

Context preservation When you click a time window on a supported error or latency chart, Intelligent Exemplar captures everything in scope at that moment: the entity, the exact time range, any active filters such as transaction.name or error.class, and selected facets. These are passed natively to the backend. You are never dropped into a generic, unfiltered trace list.

Algorithmic trace prioritization Rather than showing a random or chronologically ordered sample, Intelligent Exemplar evaluates the full trace dataset and surfaces a curated list of up to 500 traces that best represent the anomaly. Fragmented traces are filtered out automatically. Traces are weighted toward occurrences that fall within the spike window. If a single variable — such as single transaction name, host, or deployment version — accounts for more than 60% of the anomalous traces, it is surfaced automatically as the suggested starting point.

Anomalous span navigation When you select a trace from the list, the UI navigates directly to the anomalous span — not the root span, not the slowest span overall, but the span that deviates most from the baseline behavior for that operation. In a 200-span waterfall that crosses multiple downstream services, this eliminates the manual traversal required to locate where things went wrong.

Requirements

Before using Intelligent Exemplar:

• Distributed tracing must be enabled for your services.
• The more services in your trace path that are instrumented, the more complete the downstream dependency map. Uninstrumented services create gaps in the causal path.

Start an investigation

Intelligent Exemplar is available on error and latency charts in three locations:

• APM & Services > Summary: web transactions time chart and the error rate chart
• Errors Inbox: error and latency charts on the Errors Inbox home page
• Transactions: error and latency charts on the Transactions home page

The steps are the same in all three locations:

1. Click the time window on the error or latency chart that corresponds to the spike you want to investigate.
2. In the tooltip that appears, select Intelligent Traces.

Review the landing page

After selecting the spike window, the Intelligent Exemplar landing page opens with a full picture of the anomalous behavior for that service and time range. No query building or manual filter setup is required — your context from the click has already been applied.

The landing page has four components:

Summary bar

Displays the time range, the type of anomaly (latency or errors), and the number of outlier traces identified for that window.

Patterns we detected

Categorized signals that identify where the anomaly is occurring and what may be driving it. You can select one or more patterns to focus the outlier trace list on a specific signal.

Outlier traces

The ranked list of traces that exhibit anomalous behavior within the selected window. Traces are sorted by their contribution to the spike. Select any trace to open it and navigate directly to the anomalous span.

Scatter plot

A visual comparison of outlier traces against all other traces in the time window.

• X-axis: time within the selected window
• Y-axis: trace duration (for latency investigations) or error count
• Outlier traces are plotted distinctly from the All Traces baseline series

Use the scatter plot to confirm that the outlier traces cluster around the spike window rather than being distributed randomly across the full time range. A tight cluster confirms the anomaly is time-bounded and that the selected traces are genuinely representative of the spike.

Inspect the anomalous span

Selecting a trace from the outlier list opens the trace detail panel. Intelligent Exemplar does not land you at the root span — it navigates directly to the span that deviates most from the expected baseline behavior for that operation.

This matters most in deep, multi-service traces. In a 200-span waterfall that crosses five downstream services, the anomalous span may be buried several layers deep in a dependency you did not initially suspect. Intelligent Exemplar navigates you there automatically.

From the anomalous span, you can:

• Review the span attributes to see the values that deviate from baseline
• Navigate to the entity that owns the span to see its APM summary
• View the surrounding spans in the waterfall for additional context
• Run Attribute Correlation Analysis to identify the specific attribute-value pairs driving the anomaly — such as a deployment version, host, or error class

For a full guide to working with trace details and span attributes, see Understand the trace details UI page.

Understand downstream correlation

When the anomaly originates in a downstream dependency, Intelligent Exemplar maps the causal propagation path across your service dependency graph.

The system automatically analyzes correlating latency and error patterns across downstream entities and calculates the contribution of each pathway to the aggregate failure.

What's next

• Identify the root cause: Run Attribute Correlation Analysis to identify the specific attribute-value pairs — such as a deployment version, host, region, or error class — responsible for the anomaly.
• Manage trace volume: See Control distributed tracing data ingestion to manage trace ingestion costs during and after an incident.
• Tune sampling: See Configure sampling to adjust sampling rates for the affected service.