All Apps and Add-ons

Is it possible to build a timeline visualization (using the timeline app) but not use a dynamic time scale?

JWBailey
Communicator

Currently it seems that when using the timeline visualization it only supports displaying the timeline dynamically based on the _time values in your results. If my first _time value is 07:00:00 and the latest is 07:05:00, the timeline chart visualization only displays from 07:00:00 to 07:05:00.

Is it possible to force the timeline to display the full range of my search, or manually set the time range? I want the timechart to always display 00:00:00 - 23:59:59 despite the _time values of my results. I can kind of fake it by manipulating the results to include extra events with _time set to the start and end of the window I want displayed, but this has other consequences that are not desirable.

Any advice and assistance is appreciated. Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...