Visualization components

Learn how to interpret timeline components.

Visual elements

Timelines show events and intervals for each resource.


6.4 timeline.png
Each lane in a timeline represents one resource in the set you are monitoring.


Custom viz timeline interval.png
Horizontal bars or squares in a lane represent activity intervals.
Events and intervals might overlap each other in a lane.


Custom viz timeline event.png
Circles in a lane represent discrete events.
Events and intervals might overlap each other in a lane.

Interactive elements


Click on an event or interval in the visualization to open a separate search. The new search looks for events matching the time or interval that the clicked element represents.


Hover over an event or interval to show a tooltip with details about it.

Last modified on 12 August, 2016
Create a timeline query   Customize a timeline

This documentation applies to the following versions of Timeline: 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.6.1, 1.6.2

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters