All Apps and Add-ons

Timeline Graphs Max hit on the row visualization

robertlynch2020
Influencer

Hi

Is there a way yo get the timeline to graphs over the default amount of points.

From the image below we can see the row 3 to 10 have a lot of data-points, i think i must have hit the Max, as it should keep going until it hits the end.
Is there a way to increase from the default?

![alt text][1]

  <viz type="timeline_app.timeline">
        <search>
          <query>eventtype=mlc host=$host_token$ sourcetype=tps | dedup _time _raw | where Parent_ID$Parent+Child_or_Outside$$Token_Parent_ID$ $AND_OR$ Child_ID$Parent+Child_or_Outside$$Token_Parent_ID$  | eval duration = endTime-startTime | eval Method = operationIdentity | eval fullyQualifiedMethod = name."#".operationIdentity | sort 0 _time | table _time Method  fullyQualifiedMethod duration</query>
          <earliest>$tps_selection.earliest$</earliest>
          <latest>$tps_selection.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">400</option>
        <option name="timeline_app.timeline.axisTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.colorMode">categorical</option>
        <option name="timeline_app.timeline.maxColor">#DA5C5C</option>
        <option name="timeline_app.timeline.minColor">#FFE8E8</option>
        <option name="timeline_app.timeline.numOfBins">6</option>
        <option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.useColors">1</option>
        <drilldown>
          <set token="TEST_GANTT_VALUE">$row.Method$</set>
          <eval token="TEST_GANTT_start">$tps_selection.earliest$</eval>
          <eval token="TEST_GANTT_end">$tps_selection.latest$</eval>
          <!--eval token="TEST_GANTT_start">$earliest$ - 3600</eval>
          <eval token="TEST_GANTT_end">$latest$ - 3600</eval>
          <eval token="TEST_GANTT_start_ms_EPOC">$earliest$  * 1000 - 3600000</eval>
          <eval token="TEST_GANTT_end_ms_EPOC">$latest$  * 1000 - 3600000</eval>
          <eval token="TEST_GANTT_start_Display">strftime($tps_selection.earliest$,"%Y-%m-%d %H:%M:%S.%3N")</eval>
          <eval token="TEST_GANTT_end_Display">strftime($tps_selection.latest$,"%Y-%m-%d %H:%M:%S.%3N")</eval-->
          <set token="DRILL_DOWN">ON</set>
        </drilldown>
      </viz>
0 Karma
1 Solution

niketn
Legend

@robertlynch2020, you are in luck, I had just posted the limit in Timeline Custom Visualization yesterday with a workaround. Refer to my answer: https://answers.splunk.com/answers/596684/visualizations-app-for-splunk-enterprise-timelines.html#an...

PS: Increasing the number of event count may impact performance as well. So make sure you adjust as per your need. Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

woodcock
Esteemed Legend

I usually split my visualization in half along the names in the by clause. This is made easier by the trellis feature.

0 Karma

robertlynch2020
Influencer

Thanks woodcock, i will try this also :slightly_smiling_face:

0 Karma

niketn
Legend

Hi @woodcock I think Trellis is not available on Timeline (infact most Custom visualizations). I am aware of just Status Indicator Custom Visualization supporting Trellis :slightly_smiling_face:

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@robertlynch2020, you are in luck, I had just posted the limit in Timeline Custom Visualization yesterday with a workaround. Refer to my answer: https://answers.splunk.com/answers/596684/visualizations-app-for-splunk-enterprise-timelines.html#an...

PS: Increasing the number of event count may impact performance as well. So make sure you adjust as per your need. Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...