Distributed tracing - filter requests by child span attributes

[matcap]

Hi, I am new to Dynatrace and I would like to know if there is a way, in the Dynamic Tracing app, to show all the requests with a nested child span that has a specific attribute. I am currently using OpenTelemetry ingestion, and the closest i was able to get to that is to select "Span" view instead of "Requests", and then the filter input shows me all the span attributes.

EDIT: Another way I obtained the same result, was to manually add each attribute that I wanted to track to both the current span and the root span (walking the span tree upwards) in my program, but this solution is useless if the trace was started by another services.

[yanezza · Accepted solution]

In gen2 (classic view) with OA traces it is possible via backtraces/service flow feature. Currently this feature is not available as gen3 app for Opentelemetry spans, but probably it will be in future.

Via DQL this is feasible, you need to perform a query like this:
(note: it is for DB queries, but you can replicate the logic)

fetch spans
| filter db.namespace == "DB1"
| filter code.function == "executeQuery"
| filter duration > 100ms
| fields start_time, Service = entityName(dt.entity.service), Database = db.namespace, Query = db.query.text, QueryTime = duration, trace.id, subtrace.id, span.id
| join [fetch spans
        | filter isNotNull(duration) and isNotNull(endpoint.name)
        | summarize {
          child_requests = arrayRemoveNulls(collectDistinct(
          record(
                 endpoint.name,
                 duration
                 )))}, 
          by: {trace.id, subtrace.id}
        ],
        kind: leftOuter,
        on: {subtrace.id},
        executionOrder:leftFirst
| expand right.child_requests
| fields start_time, 
         Service,
         EndPoint = right.child_requests[endpoint.name],
         Duration = right.child_requests[duration],
         Database,
         Query,
         QueryTime,
         trace.id,
         span.id
| sort QueryTime desc
| filterOut isNull(EndPoint)
| summarize { requestCount = count(), avgQueryTime = avg(QueryTime), avg(Duration), collectDistinct(concat(Service, "|", EndPoint)) }, by: {Query}
//| filter requestCount > 100 
| sort avgQueryTime desc