I don't see the span links in my trace view either.  This is strange. I've noticed in your example that you use the port 4318 in the collector url and thought that maybe the problem is somehow related to the grpc protocol. But when I configure the "http/protobuf" with port 4318 in the local app, it doesn't change anything. The links just don't appear in the UI. Here is the Splunk OTel Collector configuration usiing docker compose: otelcol: image: quay.io/signalfx/splunk-otel-collector:latest environment: - SPLUNK_ACCESS_TOKEN=XXXXXXXXXXXXXXXXX - SPLUNK_REALM=eu1 ports: - "13133:13133" - "14250:14250" - "14268:14268" - "4317:4317" - "4318:4318" - "6060:6060" - "8888:8888" - "9080:9080" - "9411:9411" - "9943:9943" container_name: otelcol restart: unless-stopped ... View more

Yes, I've seen the auto-clear setting and activated it. Still, the alert is not triggered. I think, that this kind of alert (or alert condition) is not suited for single-time events like "an error occurred in a trace", because there is no metric that goes up and down (like CPU usage). This can rather be implemented with Log alerts (in Search & Reporting).  Do you know a different possibility, how one create an alert for single events that occur in Splunk? ... View more

This doesn't trigger the alert either. My original alert (with traces.count) was triggered once during my tests, when I had 3 traces with errors in a short time period, but then it wasn't triggered anymore. Is there maybe a better way to create an alert for such single events in Splunk? I think, the "static threshold" should be rather used for continuous metrics like CPU usage. But I didn't find any other option so far.   ... View more

Thanks for the quick reply. Yes, I've seen this filter switch in the Trace Analyzer, but I also want to create an alert to get notified in case of traces with an error span. It's not possible with the present fields. Actually I have a dashboard, where I use the metric traces.count and the auto-generated filter field sf_error:true. I can see the results there, but when I create an alert based on the same metric and filter, it is not triggered. I use a static threshold condition with the following settings:    P. S. You're right "error" is not a tag. I also tried to index on the tag "otel.status_code", but this also wasn't possible. ... View more