SQL Editor

SELECT name, input, output, start_time
FROM spans
WHERE start_time > now() - INTERVAL 3 DAY

-- Slow: scans everything
SELECT * FROM spans WHERE trace_id = 'abc-123'

-- Fast: scans only relevant time range
SELECT * FROM spans 
WHERE trace_id = 'abc-123'
  AND start_time > now() - INTERVAL 1 DAY

-- First: find the spans you care about
SELECT trace_id, name, input, output
FROM spans
WHERE span_type = 'LLM' AND start_time > now() - INTERVAL 1 DAY

-- Second: get trace-level data for those trace_ids
SELECT id, duration
FROM traces
WHERE id IN ('id1', 'id2', 'id3')

-- Volume and cost per cluster, straight off traces
SELECT
    c.name AS cluster,
    count() AS traces,
    round(sum(total_cost), 4) AS cost
FROM traces
ARRAY JOIN clusters AS c
WHERE start_time > now() - INTERVAL 7 DAY
  AND c.level = 1
GROUP BY cluster
ORDER BY cost DESC

-- Spans per day over the last month
SELECT
    toStartOfInterval(start_time, INTERVAL 1 DAY) AS day,
    count(*) AS span_count
FROM spans
WHERE start_time > now() - INTERVAL 1 MONTH
GROUP BY day
ORDER BY day

-- Extract token counts from LLM spans
SELECT
    name,
    simpleJSONExtractInt(attributes, 'gen_ai.usage.input_tokens') AS input_tokens,
    simpleJSONExtractInt(attributes, 'gen_ai.usage.output_tokens') AS output_tokens
FROM spans
WHERE span_type = 'LLM' AND start_time > now() - INTERVAL 1 DAY

SELECT count(*)
FROM spans
WHERE simpleJSONHas(attributes, 'gen_ai.request.structured_output_schema')

-- Extract event names from spans
SELECT 
    span_id,
    arrayMap(e -> tupleElement(e, 'name'), events) as event_names
FROM spans
WHERE length(events) > 0
  AND start_time > now() - INTERVAL 1 DAY
LIMIT 10

-- Find spans with cache_hit events
SELECT span_id, name, events
FROM spans
WHERE arrayExists(e -> tupleElement(e, 'name') = 'cache_hit', events)
  AND start_time > now() - INTERVAL 1 DAY

-- Get one row per span in each evaluation datapoint
SELECT 
    edp.id as datapoint_id,
    tupleElement(span, 'name') as span_name,
    tupleElement(span, 'duration') as span_duration,
    tupleElement(span, 'type') as span_type
FROM evaluation_datapoints edp
ARRAY JOIN edp.trace_spans as span
WHERE edp.evaluation_id = 'your-evaluation-id'
LIMIT 100

-- Convert event timestamps from nanoseconds to DateTime
SELECT 
    span_id,
    arrayMap(e -> toDateTime64(tupleElement(e, 'timestamp') / 1e9, 9, 'UTC'), events) as event_times
FROM spans
WHERE length(events) > 0
  AND start_time > now() - INTERVAL 1 DAY
LIMIT 10

-- Equivalent to tupleElement(c, 'name')
SELECT id, arrayMap(c -> c.name, clusters) AS cluster_names
FROM traces
WHERE start_time > now() - INTERVAL 1 DAY
  AND notEmpty(clusters)
LIMIT 10

DEFAULT
LLM
EXECUTOR
EVALUATOR
EVALUATION
TOOL
HUMAN_EVALUATOR
CACHED
UNKNOWN

-- Find spans with a specific tag
SELECT name, tags
FROM spans
WHERE has(tags, 'needs-review')
  AND start_time > now() - INTERVAL 1 DAY

-- Convert event timestamps to DateTime
SELECT 
    span_id,
    arrayMap(t -> toDateTime64(t / 1e9, 9, 'UTC'), tupleElement(events, 'timestamp')) as event_timestamps
FROM spans
WHERE length(events) > 0
  AND start_time > now() - INTERVAL 1 DAY

-- Find spans with specific event names
SELECT span_id, name, events
FROM spans
WHERE arrayExists(e -> tupleElement(e, 'name') = 'cache_hit', events)
  AND start_time > now() - INTERVAL 1 DAY

-- Unnest events to get one row per event
SELECT 
    span_id,
    name as span_name,
    toDateTime64(tupleElement(event, 'timestamp') / 1e9, 9, 'UTC') as event_time,
    tupleElement(event, 'name') as event_name,
    tupleElement(event, 'attributes') as event_attributes
FROM spans
ARRAY JOIN events as event
WHERE start_time > now() - INTERVAL 1 DAY
LIMIT 100

DEFAULT
EVALUATION
PLAYGROUND

-- Warning-and-above signal events on recent traces
SELECT
    id AS trace_id,
    end_time,
    e.signal_id,
    e.severity,
    substring(e.payload, 1, 2000) AS payload
FROM traces
ARRAY JOIN signal_events AS e
WHERE start_time > now() - INTERVAL 1 DAY
  AND e.severity >= 1
ORDER BY end_time DESC
LIMIT 100

-- Traces in a named cluster, no unnesting needed
SELECT id, start_time, total_cost
FROM traces
WHERE start_time > now() - INTERVAL 1 DAY
  AND arrayExists(c -> c.name = 'Checkout timeouts', clusters)
ORDER BY start_time DESC
LIMIT 100

-- Final agent output for recent traces
SELECT t.id, o.agent_output
FROM traces t
JOIN trace_outputs o ON o.trace_id = t.id
WHERE t.start_time > now() - INTERVAL 1 DAY
LIMIT 10

SELECT
    id,
    severity,
    arrayStringConcat(arrayMap(c -> c.2, cluster_details), ', ') AS cluster_names
FROM signal_events
WHERE timestamp > now() - INTERVAL 1 DAY
  AND notEmpty(cluster_details)
LIMIT 100

SELECT
    model,
    sum(total_cost) AS total_cost,
    count(*) AS call_count
FROM spans
WHERE span_type = 'LLM' AND start_time > now() - INTERVAL 7 DAY
GROUP BY model
ORDER BY total_cost DESC

SELECT name, avg(end_time - start_time) AS avg_duration_ms
FROM spans
WHERE start_time > now() - INTERVAL 1 DAY
GROUP BY name
ORDER BY avg_duration_ms DESC
LIMIT 10

SELECT
    name,
    countIf(status = 'error') AS errors,
    count(*) AS total,
    round(errors / total * 100, 2) AS error_rate
FROM spans
WHERE start_time > now() - INTERVAL 1 DAY
GROUP BY name
HAVING total > 10
ORDER BY error_rate DESC

SELECT 
    span_id, 
    name, 
    tags, 
    start_time
FROM spans
WHERE has(tags, 'needs-review')
  AND start_time > now() - INTERVAL 7 DAY
ORDER BY start_time DESC
LIMIT 100

SELECT 
    tupleElement(event, 'name') as event_name,
    count(*) as event_count
FROM spans
ARRAY JOIN events as event
WHERE start_time > now() - INTERVAL 1 DAY
GROUP BY event_name
ORDER BY event_count DESC

SELECT 
    countIf(arrayExists(e -> tupleElement(e, 'name') = 'cache_hit', events)) as cache_hits,
    count(*) as total_spans,
    round(cache_hits / total_spans * 100, 2) as cache_hit_rate
FROM spans
WHERE span_type = 'LLM'
  AND start_time > now() - INTERVAL 1 DAY

SELECT
    e.signal_id AS signal_id,
    countIf(e.severity = 2) AS critical,
    countIf(e.severity = 1) AS warning,
    countIf(e.severity = 0) AS info
FROM traces
ARRAY JOIN signal_events AS e
WHERE start_time > now() - INTERVAL 7 DAY
GROUP BY signal_id
ORDER BY critical DESC

SELECT count() AS traces
FROM traces
WHERE start_time > now() - INTERVAL 1 DAY
  AND notEmpty(signal_events)
  AND empty(clusters)

SELECT 
    evaluation_id,
    avg(total_cost) as avg_cost,
    avg(duration) as avg_duration_seconds,
    count(*) as datapoint_count
FROM evaluation_datapoints
WHERE evaluation_id = {evaluation_id:UUID}
GROUP BY evaluation_id

SELECT 
    id,
    group_id,
    scores,
    trace_spans
FROM evaluation_datapoints
WHERE arrayExists(s -> tupleElement(s, 'type') = 'LLM', trace_spans)
  AND evaluation_id = {evaluation_id:UUID}
LIMIT 100

SELECT 
    tupleElement(span, 'type') as span_type,
    count(*) as span_count,
    avg(tupleElement(span, 'duration')) as avg_duration
FROM evaluation_datapoints
ARRAY JOIN trace_spans as span
WHERE evaluation_id = {evaluation_id:UUID}
GROUP BY span_type
ORDER BY span_count DESC

POST https://api.lmnr.ai/v1/sql/query

curl -X POST https://api.lmnr.ai/v1/sql/query \
  -H "Authorization: Bearer $LMNR_PROJECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "SELECT name, span_type, start_time FROM spans WHERE start_time > now() - INTERVAL 1 DAY ORDER BY start_time DESC LIMIT 3"
  }'

{
  "data": [
    {
      "name": "openai.chat",
      "span_type": "LLM",
      "start_time": "2026-09-02 21:14:07.925746000"
    }
  ]
}

curl -X POST https://api.lmnr.ai/v1/sql/query \
  -H "Authorization: Bearer $LMNR_PROJECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "SELECT name, start_time FROM spans WHERE span_type = {span_type:String} AND start_time > {since:DateTime} ORDER BY start_time DESC LIMIT 100",
    "parameters": { "span_type": "LLM", "since": "2026-09-01 00:00:00" }
  }'

{ "error": "Query validation failed: Only SELECT statements are allowed" }