Investigate
Investigations
The Incident → Investigation → Evidence → Cause → Action model.
Docs v1.0Updated Supported
When should I use this?
- You need to explain what happened, why, and what to do next with verifiable evidence.
- You are evaluating how AutoObserve differs from dashboard-only observability tools.
- You want to understand the investigation model before connecting telemetry.
Requirements
- Metrics, logs, and traces connected via OpenTelemetryRequired
- Deployment or change signals when availableOptional
- Known incident window or service to inspectOptional
Steps
1. Understand the workflow
AutoObserve’s core workflow is not “another dashboard.”
Incident
→ Investigation
→ Evidence
→ Causal chain
→ Root cause
→ Recommended action
2. Walk the workflow guides
Each stage has a dedicated guide — work through them in order or jump to the stage you need:
- Evidence — inspectable metrics, logs, traces, and change signals
- Timeline — shared incident clock and confidence updates
- Hypotheses — competing explanations tested against evidence
- Root cause — current best explanation with uncertainty visible
3. Inspect every claim
Every root-cause claim should be backed by evidence you can open:
- Temporal correlation
- Deployment or configuration change
- Resource saturation
- Dependency propagation
- Trace / log behaviour change
- Historical baseline deviation
AI answers without inspectable evidence are not the product model.
4. Explore the canonical demo
Explore the canonical checkout-latency investigation on the Demo page — timeline, causal graph, and Inspect on every evidence card.
Did it work?
- Demo investigation opens with inspectable evidence cards
- Ready to continue the investigation workflow
Troubleshooting
Problem
No investigations appear after connecting telemetry.
Symptoms
- Empty investigation list
- No evidence for known incident window
Likely causes
- Telemetry not reaching AutoObserve
- Time range does not cover incident
Resolution
Confirm signals in [OpenTelemetry verification](/docs/connect/opentelemetry#verify-telemetry) and widen the time range.
Verify fix
An investigation appears for the selected service and window.
Problem
Investigation exists but causal chain is incomplete.
Symptoms
- Missing deploy or trace evidence
- Low confidence hypothesis
Likely causes
- Not all signal types connected
- Weak resource identity
Resolution
Connect metrics, logs, traces, and deploy signals. Align resource attributes.
Verify fix
Causal chain includes multiple evidence types you can inspect.