All Apps and Add-ons

Timeline Graphs Max hit on the row visualization

robertlynch2020
Motivator

Hi

Is there a way yo get the timeline to graphs over the default amount of points.

From the image below we can see the row 3 to 10 have a lot of data-points, i think i must have hit the Max, as it should keep going until it hits the end.
Is there a way to increase from the default?

![alt text][1]

  <viz type="timeline_app.timeline">
        <search>
          <query>eventtype=mlc host=$host_token$ sourcetype=tps | dedup _time _raw | where Parent_ID$Parent+Child_or_Outside$$Token_Parent_ID$ $AND_OR$ Child_ID$Parent+Child_or_Outside$$Token_Parent_ID$  | eval duration = endTime-startTime | eval Method = operationIdentity | eval fullyQualifiedMethod = name."#".operationIdentity | sort 0 _time | table _time Method  fullyQualifiedMethod duration</query>
          <earliest>$tps_selection.earliest$</earliest>
          <latest>$tps_selection.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="height">400</option>
        <option name="timeline_app.timeline.axisTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.colorMode">categorical</option>
        <option name="timeline_app.timeline.maxColor">#DA5C5C</option>
        <option name="timeline_app.timeline.minColor">#FFE8E8</option>
        <option name="timeline_app.timeline.numOfBins">6</option>
        <option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>
        <option name="timeline_app.timeline.useColors">1</option>
        <drilldown>
          <set token="TEST_GANTT_VALUE">$row.Method$</set>
          <eval token="TEST_GANTT_start">$tps_selection.earliest$</eval>
          <eval token="TEST_GANTT_end">$tps_selection.latest$</eval>
          <!--eval token="TEST_GANTT_start">$earliest$ - 3600</eval>
          <eval token="TEST_GANTT_end">$latest$ - 3600</eval>
          <eval token="TEST_GANTT_start_ms_EPOC">$earliest$  * 1000 - 3600000</eval>
          <eval token="TEST_GANTT_end_ms_EPOC">$latest$  * 1000 - 3600000</eval>
          <eval token="TEST_GANTT_start_Display">strftime($tps_selection.earliest$,"%Y-%m-%d %H:%M:%S.%3N")</eval>
          <eval token="TEST_GANTT_end_Display">strftime($tps_selection.latest$,"%Y-%m-%d %H:%M:%S.%3N")</eval-->
          <set token="DRILL_DOWN">ON</set>
        </drilldown>
      </viz>
0 Karma
1 Solution

niketn
Legend

@robertlynch2020, you are in luck, I had just posted the limit in Timeline Custom Visualization yesterday with a workaround. Refer to my answer: https://answers.splunk.com/answers/596684/visualizations-app-for-splunk-enterprise-timelines.html#an...

PS: Increasing the number of event count may impact performance as well. So make sure you adjust as per your need. Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

woodcock
Esteemed Legend

I usually split my visualization in half along the names in the by clause. This is made easier by the trellis feature.

0 Karma

robertlynch2020
Motivator

Thanks woodcock, i will try this also 🙂

0 Karma

niketn
Legend

Hi @woodcock I think Trellis is not available on Timeline (infact most Custom visualizations). I am aware of just Status Indicator Custom Visualization supporting Trellis 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@robertlynch2020, you are in luck, I had just posted the limit in Timeline Custom Visualization yesterday with a workaround. Refer to my answer: https://answers.splunk.com/answers/596684/visualizations-app-for-splunk-enterprise-timelines.html#an...

PS: Increasing the number of event count may impact performance as well. So make sure you adjust as per your need. Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Spunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...