Adding zoom in option to timeline chart

[smanojkumar]

Hello All,

   I'm having a timeline chart, I would like to add zoom in to this chart when we drang and select some lines, it needs to zoom.

   Can anyone hekp to find this.

Thanks in Advance!

[bowesmana]

As @ITWhisperer says, you can use selections.

See the documentation here

https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML#selection_.28...

[smanojkumar]

Hi @bowesmana & @ITWhisperer ,

   Thanks for your reply!
   I have tried using selection but facing some error even after this warning this is not working.

"Invalid child="selection" is not allowed in node="viz" "

<row>
<panel>
<title>status</title>
<viz type="timeline_app.timeline">
<search>
<query>index=$siteid$ sourcetype=logs* CAT IN ("TAT") _raw=*** (NOT CODE=* OR CODE IN ("T11"))
| head 100000
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
| fillnull value="N/A"
.............................
| eval displayname="Operational".displayname
| table _time displayname FIELD_01 duration
| append
[ search index=$siteid$ sourcetype=FSC* CAT IN ("ST") _raw=*** (NOT CODE=* OR CODE IN ("Ad13"))
| head 100000
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
..............................
| table _time displayname FIELD_01 duration
]
</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">460</option>
<option name="refresh.display">progressbar</option>
<option name="timeline_app.timeline.axisTimeFormat">SECONDS</option>
<option name="timeline_app.timeline.colorMode">categorical</option>
<option name="timeline_app.timeline.maxColor">#DA5C5C</option>
<option name="timeline_app.timeline.minColor">#FFE8E8</option>
<option name="timeline_app.timeline.numOfBins">6</option>
<option name="timeline_app.timeline.tooltipTimeFormat">SECONDS</option>
<option name="timeline_app.timeline.useColors">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<selection>
<set token="selection.earliest">$start$</set>
<set token="selection.latest">$end$</set>
<set token="start.count">$start.count$</set>
<set token="end.count">$end.count$</set>
</selection>
<drilldown><link target="_blank">search?q=
<query>index=$siteid$ sourcetype=FSC*  CAT IN ("TAT") _raw=*** (NOT CODE=* OR MARKCODE IN ("TZ11"))
| head 100000
| where _time &gt;= $selection.earliest$ AND _time ?&lt;= $selection.latest$
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
..................
| table _time displayname FIELD_01 duration
| append
[ search index=$siteid$ sourcetype=FSC* CAT IN ("ST") _raw=*** (NOT CODE=* OR CODE IN ("Ak03"))
| head 100000
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
............................................
| eval displayname="Maintenance".displayname
| table _time displayname FIELD_01 duration
]
</query></link></drilldown>
</viz>
</panel>
</row>

[ITWhisperer · Accepted solution]

Not every chart type supports zoom/selections. You may need to represent your data in a different way, e.g. column chart, which does support zoom/selections.

[ITWhisperer]

With SimpleXML, you can add a selection handler which gets tokens for the start of the timerange, end of the timerange, start of the selection and end of the selection. You can use these token values to set tokens for use elsewhere in your dashboard. This doesn't select lines, just time ranges. If you don't have a selection handler, the chart will just zoom in.