Dashboards & Visualizations

How to get the initial value of a timeline loaded from a search?

jmurdza
Explorer

When timeline is a TimelineView, timeline.val() is supposed to return the visible time range in the view. However, it only behaves as expected when the user has already zoomed in or out on a selection in the timeline. Otherwise (when the range is selected automatically from a search) it returns undefined.

A workaround I found was to use the first and last events of the search data to arrive at the right value. However, this doesn't work when there are more than 100 events, because the results are limited to 100.

What is the right way to get the initial time range of a timeline after a search?

dwaddle
SplunkTrust
SplunkTrust

This might not be what you are looking for, but there is the addinfo command which includes in the search results fields like info_min_time and info_max_time which are the time_t values bracketing the search at the time the search was run.

0 Karma

jmurdza
Explorer

@ineeman But that's exactly my problem. The search bounds don't correlate with the view bounds because the bounds of the results are often smaller than the bounds of the search. All I want to know is what the bounds of the bar graph are so that I can sync it with another graph view I have below it.

0 Karma

ineeman
Splunk Employee
Splunk Employee

@jmurdza: one option is to look at the search properties themselves. For example, if you subscribe to the search:done event on the search manager, you'll get notified when you the search is done including the job properties.

With those, you can look at the earliestTime, latestTime, indexEarliestTime and indexLatestTime to obtain the information you want. Note that not all of them are guaranteed to be there. For example, with an "All time" search, 'latestTime' will not be present as it is synonymous to "now".

0 Karma

jmurdza
Explorer

@dwaddle They're correct for the search, but my question is how to get the bounds of the view. Your workaround, although hackish, is the only way I've found to do it. If you were to post it as an answer I'd mark it as correct.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Is your search originally done over "All Time" ? If so, then (0,Infinity) are the "correct" values for the time bracket of the search. But I agree this is weird, especially if you want the "earliest event" and "latest event" from the actual search results. You could add a "| eventstats min(_time) as first_time, max(_time) as last_time" and use those, but it is a little hackish.

0 Karma

jmurdza
Explorer

When I add this to an initial search I see
info_max_time: +Infinity
info_min_time: 0.000
until I zoom in or out.
So looks like it has the same problem as timeline.val().

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...