> ## Documentation Index
> Fetch the complete documentation index at: https://private-7c7dfe99-sync-clickhouse-operator-docs-7e82242.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Event deltas with ClickStack
> Analyze trace attribute distributions and compare outlier spans with Event deltas in ClickStack
export const Image = ({img, alt, size}) => {
return
;
};
Event deltas pair a latency heatmap with automatic attribute analysis so you can see the shape of your trace data and find what makes the slow spans different — without writing queries. There are three ways to use it:
* **Distribution mode (always on)** — when no heatmap selection exists, every attribute's value distribution is shown for the current span population. Useful for spotting dominant or unusually rare values (cardinality outliers).
* **Comparison mode** — drag a rectangle on the heatmap to compare the spans inside (Selection) against everything outside (Background). Useful for isolating deviations.
* **Iterative drill-down** — click any bar to filter (or exclude) on that value. The heatmap re-renders against the filtered population, so you can keep narrowing until the cause is obvious.
Prerequisites
Event deltas require a **Trace** data source with a duration expression. Any OpenTelemetry-instrumented service producing span data works. Available in all ClickStack deployments (Managed, Open Source, ClickHouse Cloud).
Getting started
1. From the **Data Source** dropdown, select a source that holds traces. Source names are arbitrary — what matters is that the source is configured as a Trace type. The **Event Deltas** tab is only enabled for such sources.
2. In the **Analysis Mode** section, click the **Event Deltas** tab.
Event deltas is a separate analysis mode alongside **Results Table** and **Event Patterns** — switching to it swaps the view to a heatmap and an attribute analysis grid, but your search filters and time range are preserved and you can switch back at any time.
The heatmap
The heatmap plots spans across two dimensions:
* **X axis** — time
* **Y axis** — a numeric value, defaulting to span duration in milliseconds (logarithmic scale)
Color intensity indicates event count per bucket — brighter means more spans.
You can read patterns straight off the heatmap: bimodal latency, latency spikes at specific times, or a band of consistently slow spans. To investigate a region, click and drag a rectangle on it — that becomes your **Selection** and switches the analysis below into comparison mode.
Distribution mode: cardinality outliers
With no selection on the heatmap, the analysis panel shows one bar chart per attribute, computed across all matching spans. The legend reads **All spans**.
Attributes are ranked by how concentrated their values are — those dominated by a few values appear first; uniform, high-entropy attributes are deprioritized.
Use distribution mode when you want to understand the **cardinality shape** of your data:
* **Highs** — which services, endpoints, status codes, or hosts dominate your span population? Often surfaces a single tenant, version, or route doing most of the traffic.
* **Lows** — values that occur but rarely. A status code that appears in just `0.5%` of spans, or one host that barely shows up, can be the most interesting signal — the long tail is where regressions and bad actors hide.
Combine with the search bar to narrow the population first (e.g., only error spans, only client spans, only one endpoint), then read the distributions for that subset.
Comparison mode: deviations from normal
Click and drag a rectangle on the heatmap, then click **Filter by Selection** to enter comparison mode. The selected spans become the **Selection** (red bars); everything outside becomes the **Background** (green bars). Each attribute chart then shows both populations side by side, sorted so the attributes with the largest divergence appear first — a value present almost exclusively in one side (or absent from one side) is the strongest candidate for what differs.
Any rectangle works, but three kinds of selection answer different questions:
* **A region that feels off** — a band of higher latency confined to a particular time window, the onset of a visible regression, a cluster of spans that doesn't fit the rest. Use this when something in the heatmap already looks suspicious.
* **Full-width vertical split (slow vs fast)** — drag a rectangle covering the entire time range but only the upper latency band (slow tail), leaving the bulk of fast spans as Background. Compares what makes the slow spans different from the fast ones.
* **Full-height horizontal split (before vs after)** — drag a rectangle covering the full latency axis but only the time window after a suspected change, leaving the earlier period as Background. Compares what changed between the two time windows, independent of latency.
Vertical and horizontal full-range splits are especially useful when nothing in the heatmap jumps out visually — they let the attribute analysis do the work of finding the deviation rather than relying on the eye.
Iterative drill-down
Comparison and distribution modes are most powerful when chained. Click any bar to open a popover with three actions:
* **Filter** — keep only spans with this value
* **Exclude** — remove spans with this value
* **Copy** — copy the value to the clipboard
After applying a filter or exclude, the heatmap selection is cleared, the heatmap re-renders against the new population, and distribution mode resumes against that filtered set. Watch how the heatmap reshapes — a successful filter visibly removes the slow band or collapses the bimodal split. Repeat: spot the next suspicious value, filter, look at the new heatmap, look at the new distributions. A few iterations usually narrow a regression to one or two attributes.
Aggregated **Other (N)** buckets that collapse low-frequency values aren't clickable. To filter for a specific value within that bucket, use the [search bar](/products/clickstack/features/search) directly.
When the population is small enough, switch to the **Results Table** tab to inspect individual traces — your filters carry over.
Customize the heatmap
The gear icon in the top-right of the heatmap opens the **Heatmap Settings** drawer.
| Parameter | Default | Description |
| --------- | ---------------- | -------------------------------------------------------------------------------------------------------- |
| **Scale** | Log | Log handles wide latency ranges; Linear is better for narrow, uniform distributions. |
| **Value** | `(Duration)/1e6` | Any numeric expression — e.g., response size, error rate, a custom span attribute. |
| **Count** | `count()` | Aggregation for color — switch to `avg()`, `sum()`, `p95()`, or expressions like `countDistinct(field)`. |
Click **Apply** to update the heatmap; the attribute analysis below follows.
**Heatmap on dashboards**
The same heatmap is also available as a [dashboard tile](/products/clickstack/features/dashboards/overview#create-a-tile-heatmap), which is useful when you want to monitor the distribution shape over time outside the Event Deltas drill-down flow.
Troubleshooting
Event Deltas tab isn't visible
The **Event Deltas** tab under **Analysis Mode** only appears when a **Trace** source with a duration expression is selected. Verify that your data source is configured as a Trace type and has span data with duration information.
Attribute charts show few or no results
If the sample is too small (fewer than a few dozen spans), distributions may not be statistically meaningful. Widen the time range or relax your search filters.