Use the timeline to investigate patterns of events
The timeline is a visual representation of the number of events that occur at each point in time. It shows the distribution of events over time. Mouseover a bar to see the count of events. Click on a bar to drill-down to that time. Drilling down in this way does not run a new search, it just filters the results from the previous search. You can use the timeline to highlight patterns or clusters of events or investigate peaks (spikes in activity) and lows (possible server downtime) in event activity.
The timeline options are located above the timeline. You can zoom in and zoom out and change the scale of the chart. Collapsing the time line is handy if you want more room for events and are not concerned with the time line. Click to restore it when you are.
Change the scale of the timeline
You can view the timeline on two scales: linear or logarithmic (log).
The following image shows the search results for all events in the second quarter on a linear scale.
The following image shows the same search results for all events in the second quarter on a log scale.
Zoom in and zoom out to investigate events
Zoom in and out changes the time focus; for example, zooming in will change timeline bars from hours to minutes. Clicking the bar drills down to events that minute. Zooming out pulls up a level to see events over hours or days instead of minutes.
Click and drag your mouse over a cluster of bars in the timeline.
- Your search results update to display only the events that occurred in that selected time range.
- If you click zoom in, the timeline updates to display only the span of events that you selected.
Click on one bar in the timeline.
- Your search results update to display only the events that occur at that selected point.
- Once again, if you click zoom in, the timeline updates to display only the events in that selected point.
If you want to select all the the bars in the timeline (undo your previous selection) click select all. This option is only available after you've selected one or more bars and before you selected either zoom in or zoom out.
Change the time range to narrow your search
Search and report in real time
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7