All Apps and Add-ons

Is it possible to build a timeline visualization (using the timeline app) but not use a dynamic time scale?

JWBailey
Communicator

Currently it seems that when using the timeline visualization it only supports displaying the timeline dynamically based on the _time values in your results. If my first _time value is 07:00:00 and the latest is 07:05:00, the timeline chart visualization only displays from 07:00:00 to 07:05:00.

Is it possible to force the timeline to display the full range of my search, or manually set the time range? I want the timechart to always display 00:00:00 - 23:59:59 despite the _time values of my results. I can kind of fake it by manipulating the results to include extra events with _time set to the start and end of the window I want displayed, but this has other consequences that are not desirable.

Any advice and assistance is appreciated. Thanks,

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...