Efficient joins using a sliding join window

1 . A computer-implemented method comprising:

receiving a request to perform a query in association with a dataset on an observability platform, the request including user input defining the query, wherein the query includes one or more filters to identify one or more spans in a trace;

retrieving the dataset including a number of event identifiers based on the one or more spans identified in the trace, the dataset comprising a plurality of events having associated timestamps, wherein the dataset is distributed across a plurality of nodes, each node having a data store;

generating a join window that is dynamically sized based on the number of event identifiers in the dataset;

generating a list of data segments based on the retrieved dataset, each data segment comprising a number of data rows retrieved from the data store of a node from the plurality of nodes;

storing each data segment from the list of data segments in a single table:

using the join window, processing the list of data segments stored in the single table by reading each data row of the single table into the join window to perform one or more relational join operations on the dataset based on the one or more filters in the query, wherein a join is completed whenever a match is found by comparing the data row being read to other data rows in the join window;

generating a result set comprising completed joins based on the processed list of data segments; and

providing the result set as a response to the request for display on the observability platform.

2 . The computer-implemented method of claim 1 , the method further comprising:

sorting the list of data segments stored in the single table based on the associated timestamps of the plurality of events; and

executing the one or more relational join operations on the dataset upon processing the sorted list of data segments to perform the query.

3 . The computer-implemented method of claim 2 , further comprising:

determining one or more executed join operations includes particular data segments from a neighboring node; and

retrieving the particular data segments from the neighboring node into memory as part of the join window.

4 . The computer-implemented method of claim 1 , wherein the one or more relational join operations are performed in memory on the list of the data segments for the dataset based on identified one or more join key values in the query using the join window.

5 . The computer-implemented method of claim 1 , wherein the one or more relational join operations are performed using an application programming interface call to a web service communicatively coupled to a data analysis engine.

6 . The computer-implemented method of claim 1 , wherein the result set of the query comprises a plurality of data values that detail the one or more spans in the trace based on the one or more filters in the query.

7 . The computer-implemented method of claim 5 , wherein providing the result set as the response to the query comprises:

generating a user interface comprising a plurality of data visualizations of the result set, the user interface generated on the observability platform;

receiving a selection of one of a plurality of data values in the user interface on the observability platform; and

providing for display in the user interface the one or more spans in the trace based on the selection.

8 . A system comprising one or more processors and memory operably coupled with the one or more processors, wherein the memory stores instructions that, in response to execution of the instructions by one or more processors, cause the one or more processors to perform operations including:

receiving a request to perform a query in association with a dataset on an observability platform, the request including user input defining the query, wherein the query includes one or more filters to identify one or more spans in a trace;

retrieving the dataset including a number of event identifiers based on the one or more spans identified in the trace, the dataset comprising a plurality of events having associated timestamps, wherein the dataset is distributed across a plurality of nodes, each node having a data store;

generating a join window that is dynamically sized based on the number of event identifiers in the dataset;

generating a list of data segments based on the retrieved dataset, each data segment comprising a number of data rows retrieved from the data store of a node from the plurality of nodes;

storing each data segment from the list of data segments in a single table:

using the join window, processing the list of data segments stored in the single table by reading each data row of the single table into the join window to perform one or more relational join operations on the dataset based on the one or more filters in the query, wherein a join is completed whenever a match is found by comparing the data row being read to other data rows in the join window;

generating a result set comprising completed joins based on the processed list of data segments; and

providing the result set as a response to the request for display on the observability platform.

9 . The system of claim 8 , wherein the operations further comprise:

sorting the list of data segments stored in the single table based on the associated timestamps of the plurality of events; and

executing the one or more relational join operations on the dataset upon processing the sorted list of data segments to perform the query.

10 . The system of claim 9 , wherein the operations further comprise:

determining one or more executed join operations includes particular data segments from a neighboring node; and

retrieving the particular data segments from the neighboring node into memory as part of the join window.

11 . The system of claim 8 , wherein the one or more relational join operations are performed in memory on the list of the data segments for the dataset based on identified one or more join key values in the query using the join window.

12 . The system of claim 8 , wherein the one or more relational join operations are performed using an application programming interface call to a web service communicatively coupled to a data analysis engine.

13 . The system of claim 8 , wherein the result set of the query comprises a plurality of data values that detail the one or more spans in the trace based on the one or more filters in the query.

14 . The system of claim 13 , wherein providing the result set as the response to the query comprises:

generating a user interface comprising a plurality of data visualizations of the result set, the user interface generated on the observability platform;

receiving a selection of one of the plurality of data values in the user interface on the observability platform; and

providing for display in the user interface the one or more spans in the trace based on the selection.

15 . A non-transitory computer-readable storage media storing one or more sequences of instructions which, when executed using one or more processors, cause the one or more processors to execute a method comprising:

receiving a request to perform a query in association with a dataset on an observability platform, the request including user input defining the query, wherein the query includes one or more filters to identify one or more spans in a trace;

retrieving the dataset including a number of event identifiers based on the one or more spans identified in the trace, the dataset comprising a plurality of events having associated timestamps, wherein the dataset is distributed across a plurality of nodes, each node having a data store;

generating a join window that is dynamically sized based on the number of event identifiers in the dataset;

generating a list of data segments based on the retrieved dataset, each data segment comprising a number of data rows retrieved from the data store of a node from the plurality of nodes;

storing each data segment from the list of data segments in a single table:

using the join window, processing the list of data segments stored in the single table by reading each data row of the single table into the join window to perform one or more relational join operations on the dataset based on the one or more filters in the query, wherein a join is completed whenever a match is found by comparing the data row being read to other data rows in the join window;

generating a result set comprising completed joins based on the processed list of data segments; and

providing the result set as a response to the request for display on the observability platform.

16 . The non-transitory computer-readable storage media of claim 15 , wherein the method further comprises:

sorting the list of data segments stored in the single table based on the associated timestamps of the plurality of events; and

executing the one or more relational join operations on the dataset upon processing the sorted list of data segments to perform the query.

17 . The non-transitory computer-readable storage media of claim 16 , wherein the method further comprises:

determining one or more executed join operations includes particular data segments from a neighboring node; and

retrieving the particular data segments from the neighboring node into memory as part of the join window.

18 . The non-transitory computer-readable storage media of claim 15 , wherein the one or more relational join operations are performed on the list of the data segments for the dataset based on identified one or more join key values in the query using the join window in-memory.

19 . The non-transitory computer-readable storage media of claim 18 , wherein the result set of the query comprises a plurality of data values that detail the one or more spans in the trace based on the one or more filters in the query.

20 . The non-transitory computer-readable storage media of claim 15 , providing the result set as the response to the query comprises:

generating a user interface comprising a plurality of data visualizations of the result set, the user interface generated on the observability platform;

receiving a selection of one of a plurality of data values in the user interface on the observability platform; and

providing for display in the user interface the one or more spans in the trace based on the selection.