topic Determine Start Time in DQL Queries for Accurate Analysis in DQL

Determine Start Time in DQL Queries for Accurate Analysis

deni — Fri, 02 Jan 2026 09:12:05 GMT

Hi,

I have the following two queries and wondering what is the difference:

fetch spans | makeTimeseries sum(duration)

fetch spans | makeTimeseries sum(duration), time:start_time

I tried both in Playground, but I can’t see any difference. I also thought about using a join command to compare the responses, but I don’t see which column I could use for the join. According to the documentation:

time expression The expression that provides the timestamp for a record, which will be assigned to a series bucket. If the current data does not contain a field timestamp the parameter needs to be specified, referencing the time field. The default value is timestamp. If the timestamp field doesn't exist, the second default value is start_time.

e.g. the parameter needs to be specified if there is no column timestamp.

In the case of the spans, I don't see timestamp column, but it seem that the query still works without specifying time:start_time.

This questions comes from the DQL course in the university, this is the exact task:

Evaluating Data over time The operations team is starting to suspect some of these are being caused by long request times. Modify the below query to display maximum duration of spans over time. HINT: use the time:start_time argument to set which timestamp is used for the timeseries.

The query from which we have to start is:

fetch spans

Thanks!

Regards, Deni

Re: Exactly what time:start_time do?

krzysztof_hoja — Sun, 17 Aug 2025 18:23:27 GMT

It looks like documentation unclear. IMHO it should sound like :

If the current data does not contain a field timestamp or field start_time the parameter needs to be specified

now it is explained in additional sentence:

If the timestamp field doesn't exist, the second default value is start_time.

Re: Exactly what time:start_time do?

deni — Sun, 17 Aug 2025 18:43:31 GMT

I suppose this means the HINT is also not correct? For example, as I suspected, the result is the same with or without time:start_time (since when timestamp is missing, the default becomes start_time).

I assume this parameter is only useful in cases where both timestamp and start_time exist. Do you maybe have an example of such a case?

Re: Exactly what time:start_time do?

IzabelaRokita — Wed, 17 Dec 2025 13:21:02 GMT

Hey @deni ,
I just wanted to check in and see if you still need help with this. If so, I’d be happy to look into it for you! 😊
Please let me know what works best for you.

Re: Exactly what time:start_time do?

deni — Tue, 30 Dec 2025 10:46:01 GMT

Hi @IzabelaRokita ,

My last question is still opened ...