explore

Query aggregate event data (Explore)

Usage

sentry explore [<target>]

Query aggregate event data (Explore)

Arguments:

Argument	Description
[<target>]	<org>/ (all projects), <org>/<project>, or <project> (search)

Options:

Option	Description
-F, --field <field>...	API field or aggregate (repeatable). E.g., title, "count()", "p50(span.duration)"
-m, --metric <metric>	Metric name for --dataset metrics. Auto-resolves type/unit via API.
--agg <agg>	Aggregation for --metric (sum, avg, count, p50, p95, etc.) (default: "sum")
-d, --dataset <dataset>	Dataset to query (errors, spans, metrics, logs, replays; transaction(s) routes to spans) (default: "errors")
-q, --query <query>	Search query (Sentry search syntax)
-s, --sort <sort>	Sort field (prefix with - for desc, e.g., "-count()")
-e, --environment <environment>...	Environment filter (repeatable, comma-separated)
-n, --limit <limit>	Number of table rows (1-1000, default: 25)
-b, --time-series <time-series>	Query time series (default: auto; optional bucket duration, e.g., 15m)
-t, --period <period>	Time range: "7d", "2024-01-01..2024-02-01", ">=2024-01-01" (default: "24h")
-f, --fresh	Bypass cache, re-detect projects, and fetch fresh data
-c, --cursor <cursor>	Navigate pages: "next", "prev", "first" (or raw cursor string)

Examples:

# Top errors in the last 24 hours, scoped to a project
sentry explore my-org/cli

# All projects in an organization
sentry explore my-org/

# Bare project slug (searches across organizations)
sentry explore cli

# Auto-detect the project from DSN/config
sentry explore

# Errors with user impact for a specific UTC window
sentry explore my-org/cli -F title -F "count()" -F "count_unique(user)" --period "2024-01-15T00:00:00Z..2024-01-16T00:00:00Z"

# Filter by error type (combined with the project filter)
sentry explore my-org/cli -F title -F "count()" -q "error.type:TypeError" --period 1h

# Combine span filters while keeping the project scope
sentry explore my-org/cli --dataset spans -F "count()" -q "span.op:http.client OR span.status:internal_error"

# Count a metric only for a matching release
sentry explore my-org/ --dataset metrics -F 'count_if(`release:example`,value,request_duration,distribution,none)'

# Span operation latency
sentry explore my-org/cli -F span.op -F "p50(span.duration)" -F "p95(span.duration)" --dataset spans --period 1h

# Top spans by count
sentry explore my-org/cli -F span.op -F "count()" --dataset spans --sort "-count()"

# Error counts in 15-minute buckets over the last hour
sentry explore my-org/cli --time-series 15m --period 1h

# Latency over time with automatic bucket duration, as JSON
sentry explore my-org/cli --dataset spans -F "p95(span.duration)" --time-series --period 24h --json

# A metric over time using its discovered type and unit
sentry explore my-org/cli --dataset metrics -m cache.hit_rate --agg avg -b -t 1h

# Sum a custom metric (e.g., LLM token usage) across an organization
sentry explore my-org/ -m llm.token_usage --dataset metrics --period 7d

# Break a metric down by a tag column
sentry explore my-org/seer -F gen_ai.request.model -m llm.token_usage --dataset metrics --period 7d

# Use a different metric aggregation (default is sum)
sentry explore my-org/ -m cache.hit_rate --agg avg --dataset metrics

# Use the raw tracemetrics format
sentry explore my-org/ -F "sum(value,llm.token_usage,distribution,none)" --dataset metrics --period 7d

# Filter replays by activity level
sentry explore my-org/cli --dataset replays -F activity -F duration -F count_errors --period 7d

# Log severity counts in the last hour
sentry explore my-org/cli -F severity -F "count()" --dataset logs --period 1h

# Pipe JSON to jq
sentry explore my-org/cli -F title -F "count()" --json | jq '.data[:5]'

All commands support --json for machine-readable output and --fields to select specific JSON fields.

Time series

Use --time-series (-b) to see how an aggregate changes over time. The target, --query, --environment, and --period filters work as they do for tabular queries. Without --field, temporal queries count matching events in each time bucket. For performance analysis, select aggregates such as p95(span.duration); repeat --field to request more than one series.

With no value or auto, the CLI chooses a bucket interval from the requested time range. Pass a duration, such as --time-series 15m or -b 15m, to set the bucket width. When omitting the value, place an explicit target before the flag. Use --period (-t) to set the overall time range. Each invocation returns a snapshot and exits; it does not follow live data.

Temporal queries support errors, spans, logs, and metrics. Metrics require --metric or an explicit aggregate in the raw tracemetrics format described below. Grouping columns, replays, --sort, --limit, and --cursor are not supported in temporal mode. Use a tabular query to break down a series by a field or inspect individual events.

JSON output includes timeSeries, meta, and dataset. Each series retains its bucket timestamps, values, and available sampling or completeness metadata. Null values remain null, and incomplete buckets remain marked as incomplete; recent buckets may still be waiting for ingestion or for the interval to end. Temporal output has no pagination cursor.

In terminals with Kitty or Sixel graphics support, each numeric aggregate gets its own chart with a value axis, UTC time labels, and a colored aggregate legend, using the same presentation as dashboard charts. Null and incomplete buckets leave gaps; a table below the chart retains their timestamps, original values, and completeness reasons. Complete buckets have at least a baseline tick, including zero values. The interval and sampling or scan warnings appear in a compact caption below each chart. The full aggregate expression is included there when the legend abbreviates it. Ingestion details follow the results. All times are UTC; the query range in the header is distinct from the bucket-start labels on the axes.

Other terminals use tables, as do series with strings, negative values, irregular bucket spacing, too many buckets to draw individually, or too little room for readable axes. The CLI never averages buckets to fit an Explore chart. Use SENTRY_NO_GRAPHICS=1 or the graphics default setting to keep table output. Graphics do not change --json or --fields.

Metrics

Use --metric (-m) to query metrics by name. The CLI auto-resolves the metric's type and unit. You can also use the raw tracemetrics format: aggregation(value,metric_name,metric_type,unit).

Datasets

Dataset	Description
errors	Error events (default)
spans	Span/transaction data for performance analysis
metrics	Custom and built-in metrics
logs	Structured log entries
replays	Session replay recordings

Rejected expressions

Aggregate support depends on the selected dataset. When Sentry rejects a known expression supplied through --field or --sort, Explore preserves the backend detail and explains how to correct that expression. It does not rewrite or rerun the query.

Use count() to count spans. For the earliest or latest log time, use min(timestamp_precise) or max(timestamp_precise); their results are Unix timestamps in nanoseconds, rather than formatted timestamps. A function accepted by one dataset may be unsupported by another.

Target Patterns

Target	Behavior
<org>/<project>	Scopes the query to that project
<org>/	All projects in org (no project filter)
<project>	Searches for project across all accessible orgs
(omitted)	Auto-detect from DSN/config