Hi
Is there a way yo get the timeline to graphs over the default amount of points.
From the image below we can see the row 3 to 10 have a lot of data-points, i think i must have hit the Max, as it should keep going until it hits the end.
Is there a way to increase from the default?
![alt text][1]
<viz type="timeline_app.timeline">
<search>
<query>eventtype=mlc host=$host_token$ sourcetype=tps | dedup _time _raw | where Parent_ID$Parent+Child_or_Outside$$Token_Parent_ID$ $AND_OR$ Child_ID$Parent+Child_or_Outside$$Token_Parent_ID$ | eval duration = endTime-startTime | eval Method = operationIdentity | eval fullyQualifiedMethod = name."#".operationIdentity | sort 0 _time | table _time Method fullyQualifiedMethod duration</query>
<earliest>$tps_selection.earliest$</earliest>
<latest>$tps_selection.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="height">400</option>
<option name="timeline_app.timeline.axisTimeFormat">SUBSECONDS</option>
<option name="timeline_app.timeline.colorMode">categorical</option>
<option name="timeline_app.timeline.maxColor">#DA5C5C</option>
<option name="timeline_app.timeline.minColor">#FFE8E8</option>
<option name="timeline_app.timeline.numOfBins">6</option>
<option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>
<option name="timeline_app.timeline.useColors">1</option>
<drilldown>
<set token="TEST_GANTT_VALUE">$row.Method$</set>
<eval token="TEST_GANTT_start">$tps_selection.earliest$</eval>
<eval token="TEST_GANTT_end">$tps_selection.latest$</eval>
<!--eval token="TEST_GANTT_start">$earliest$ - 3600</eval>
<eval token="TEST_GANTT_end">$latest$ - 3600</eval>
<eval token="TEST_GANTT_start_ms_EPOC">$earliest$ * 1000 - 3600000</eval>
<eval token="TEST_GANTT_end_ms_EPOC">$latest$ * 1000 - 3600000</eval>
<eval token="TEST_GANTT_start_Display">strftime($tps_selection.earliest$,"%Y-%m-%d %H:%M:%S.%3N")</eval>
<eval token="TEST_GANTT_end_Display">strftime($tps_selection.latest$,"%Y-%m-%d %H:%M:%S.%3N")</eval-->
<set token="DRILL_DOWN">ON</set>
</drilldown>
</viz>
@robertlynch2020, you are in luck, I had just posted the limit in Timeline Custom Visualization yesterday with a workaround. Refer to my answer: https://answers.splunk.com/answers/596684/visualizations-app-for-splunk-enterprise-timelines.html#an...
PS: Increasing the number of event count may impact performance as well. So make sure you adjust as per your need. Please try out and confirm!
I usually split my visualization in half along the names in the by
clause. This is made easier by the trellis
feature.
Thanks woodcock, i will try this also 🙂
Hi @woodcock I think Trellis is not available on Timeline (infact most Custom visualizations). I am aware of just Status Indicator Custom Visualization supporting Trellis 🙂
@robertlynch2020, you are in luck, I had just posted the limit in Timeline Custom Visualization yesterday with a workaround. Refer to my answer: https://answers.splunk.com/answers/596684/visualizations-app-for-splunk-enterprise-timelines.html#an...
PS: Increasing the number of event count may impact performance as well. So make sure you adjust as per your need. Please try out and confirm!