Described embodiments provide systems and methods for displaying a service graph in association with a time of a detected anomaly. A device may store a plurality of snapshots of a service graph of a plurality of microservices. Each of the snapshots of the service graphs include metrics at a respective time increment from execution of each of the plurality of microservices. The device may detect an anomaly with operation of one or more microservices of the plurality of services. The device may identify a set of snapshots of the service graph within a predetermined time period of a time of the anomaly. The device may display each of the snapshots in the set of snapshots of in sequence corresponding to time increments within the predetermined time period of the time of the anomaly.