Use the timeline to investigate patterns of events
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Use the timeline to investigate patterns of events
The timeline is a visual representation of the number of events that occur at each point in time. It shows the distribution of events over time. Mouseover a bar to see the count of events. Click on a bar to drill-down to that time. Drilling down in this way does not run a new search, it just filters the results from the previous search. You can use the timeline to highlight patterns or clusters of events or investigate peaks (spikes in activity) and lows (possible server downtime) in event activity.
The timeline options are located above the timeline. You can zoom in and zoom out and change the scale of the chart. Collapsing the time line is handy if you want more room for events and are not concerned with the time line. Click to restore it when you are.
Change the scale of the timeline
You can view the timeline on two scales: linear or logarithmic (log).
The following image shows the search results for all events in the second quarter on a linear scale.
The following image shows the same search results for all events in the second quarter on a log scale.
Zoom in and zoom out to investigate events
Zoom in and out changes the time focus; for example, zooming in will change timeline bars from hours to minutes. Clicking the bar drills down to events that minute. Zooming out pulls up a level to see events over hours or days instead of minutes.
Click and drag your mouse over a cluster of bars in the timeline.
- Your search results update to display only the events that occurred in that selected time range.
- If you click zoom in, the timeline updates to display only the span of events that you selected.
Click on one bar in the timeline.
- Your search results update to display only the events that occur at that selected point.
- Once again, if you click zoom in, the timeline updates to display only the events in that selected point.
If you want to select all the the bars in the timeline (undo your previous selection) click select all. This option is only available after you've selected one or more bars and before you selected either zoom in or zoom out.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.
Comments
Is there an easy way to shift the timeline? In the examples on this page, the major units are months, so one would expect a way to tell the timeline "move forward one month" or "move backwards one month". Again, using the examples on this page, you might notice a trend and want to see if it continues in July 2009. How can you easily display May 2009, June 2009 and July 2009 without typing dates in search parameters?
@Dzaner, I don't think they have this option. I would love to know if it did exist though.