How to get the initial value of a timeline loaded from a search?

[jmurdza]

When timeline is a TimelineView, timeline.val() is supposed to return the visible time range in the view. However, it only behaves as expected when the user has already zoomed in or out on a selection in the timeline. Otherwise (when the range is selected automatically from a search) it returns undefined.

A workaround I found was to use the first and last events of the search data to arrive at the right value. However, this doesn't work when there are more than 100 events, because the results are limited to 100.

What is the right way to get the initial time range of a timeline after a search?

[dwaddle]

This might not be what you are looking for, but there is the addinfo command which includes in the search results fields like info_min_time and info_max_time which are the time_t values bracketing the search at the time the search was run.

[jmurdza]

@ineeman But that's exactly my problem. The search bounds don't correlate with the view bounds because the bounds of the results are often smaller than the bounds of the search. All I want to know is what the bounds of the bar graph are so that I can sync it with another graph view I have below it.

[ineeman]

@jmurdza: one option is to look at the search properties themselves. For example, if you subscribe to the search:done event on the search manager, you'll get notified when you the search is done including the job properties.

With those, you can look at the earliestTime, latestTime, indexEarliestTime and indexLatestTime to obtain the information you want. Note that not all of them are guaranteed to be there. For example, with an "All time" search, 'latestTime' will not be present as it is synonymous to "now".

[jmurdza]

@dwaddle They're correct for the search, but my question is how to get the bounds of the view. Your workaround, although hackish, is the only way I've found to do it. If you were to post it as an answer I'd mark it as correct.

[dwaddle]

Is your search originally done over "All Time" ? If so, then (0,Infinity) are the "correct" values for the time bracket of the search. But I agree this is weird, especially if you want the "earliest event" and "latest event" from the actual search results. You could add a "| eventstats min(_time) as first_time, max(_time) as last_time" and use those, but it is a little hackish.

[jmurdza]

When I add this to an initial search I see
info_max_time: +Infinity
info_min_time: 0.000
until I zoom in or out.
So looks like it has the same problem as timeline.val().