topic Re: Timeline Graphs Max hit on the row visualization in All Apps and Add-ons

Timeline Graphs Max hit on the row visualization

robertlynch2020 — Thu, 07 Dec 2017 17:16:28 GMT

Is there a way yo get the timeline to graphs over the default amount of points.

From the image below we can see the row 3 to 10 have a lot of data-points, i think i must have hit the Max, as it should keep going until it hits the end.
Is there a way to increase from the default?

![alt text][1]

  <viz type="timeline_app.timeline">
        <search>
          <query>eventtype=mlc host=$host_token$ sourcetype=tps | dedup _time _raw | where Parent_ID$Parent+Child_or_Outside$$Token_Parent_ID$ $AND_OR$ Child_ID$Parent+Child_or_Outside$$Token_Parent_ID$  | eval duration = endTime-startTime | eval Method = operationIdentity | eval fullyQualifiedMethod = name."#".operationIdentity | sort 0 _time | table _time Method  fullyQualifiedMethod duration</query>
          <earliest>$tps_selection.earliest$</earliest>
          <latest>$tps_selection.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">400</option>
        <option name="timeline_app.timeline.axisTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.colorMode">categorical</option>
        <option name="timeline_app.timeline.maxColor">#DA5C5C</option>
        <option name="timeline_app.timeline.minColor">#FFE8E8</option>
        <option name="timeline_app.timeline.numOfBins">6</option>
        <option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.useColors">1</option>
        <drilldown>
          <set token="TEST_GANTT_VALUE">$row.Method$</set>
          <eval token="TEST_GANTT_start">$tps_selection.earliest$</eval>
          <eval token="TEST_GANTT_end">$tps_selection.latest$</eval>
          <!--eval token="TEST_GANTT_start">$earliest$ - 3600</eval>
          <eval token="TEST_GANTT_end">$latest$ - 3600</eval>
          <eval token="TEST_GANTT_start_ms_EPOC">$earliest$  * 1000 - 3600000</eval>
          <eval token="TEST_GANTT_end_ms_EPOC">$latest$  * 1000 - 3600000</eval>
          <eval token="TEST_GANTT_start_Display">strftime($tps_selection.earliest$,"%Y-%m-%d %H:%M:%S.%3N")</eval>
          <eval token="TEST_GANTT_end_Display">strftime($tps_selection.latest$,"%Y-%m-%d %H:%M:%S.%3N")</eval-->
          <set token="DRILL_DOWN">ON</set>
        </drilldown>
      </viz>

Re: Timeline Graphs Max hit on the row visualization

niketn — Thu, 07 Dec 2017 17:43:45 GMT

@robertlynch2020, you are in luck, I had just posted the limit in Timeline Custom Visualization yesterday with a workaround. Refer to my answer: https://answers.splunk.com/answers/596684/visualizations-app-for-splunk-enterprise-timelines.html#answer-595998

PS: Increasing the number of event count may impact performance as well. So make sure you adjust as per your need. Please try out and confirm!

Re: Timeline Graphs Max hit on the row visualization

woodcock — Thu, 07 Dec 2017 18:06:25 GMT

I usually split my visualization in half along the names in the by clause. This is made easier by the trellis feature.

Re: Timeline Graphs Max hit on the row visualization

robertlynch2020 — Fri, 08 Dec 2017 13:34:15 GMT

Thanks woodcock, i will try this also 🙂

Re: Timeline Graphs Max hit on the row visualization

niketn — Fri, 08 Dec 2017 16:49:02 GMT

Hi @woodcock I think Trellis is not available on Timeline (infact most Custom visualizations). I am aware of just Status Indicator Custom Visualization supporting Trellis 🙂