All Apps and Add-ons

Is it possible to build a timeline visualization (using the timeline app) but not use a dynamic time scale?

JWBailey
Communicator

Currently it seems that when using the timeline visualization it only supports displaying the timeline dynamically based on the _time values in your results. If my first _time value is 07:00:00 and the latest is 07:05:00, the timeline chart visualization only displays from 07:00:00 to 07:05:00.

Is it possible to force the timeline to display the full range of my search, or manually set the time range? I want the timechart to always display 00:00:00 - 23:59:59 despite the _time values of my results. I can kind of fake it by manipulating the results to include extra events with _time set to the start and end of the window I want displayed, but this has other consequences that are not desirable.

Any advice and assistance is appreciated. Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...