Timeline Charts

A chart is a visual representation of your data against time. By using elements such as lines (in a line chart), a chart displays a series of numeric data in a graphical format.

You can add multiple result tabs to view the same data in different formats. The timeline chart displays the event distribution for a specified time period. You can use different options to view chart details, zoom in and out of the chart, and show or hide the chart panel.
Note: Timeline charts are not available in GROUP BY queries. In case of queries that do not require a time filter (such as infrastructure queries), timeline charts are off by default. If turned on, the message No data to display is displayed.

From the Timeline Charts panel, you can perform the following tasks:

  • Showing or hiding the Timeline Charts panel

    Click the slider icon located in the upper-right corner of the results to show or hide the panel.

  • Zooming in or zooming out of timeline charts

    You can zoom in or zoom out of a particular area of the timeline chart using the time-range picker.

    Grab the handles on the X-axis time-range picker, it turns into a slider. Drag the slider across the X-axis to define the time range that you want to zoom in. The timeline chart is updated for the selected time.

    The following timeline chart displays the zoomed in data for a specified time range and the Data panel shows the filtered results for the corresponding time range.

    You can expand and collapse the time range by dragging the borders of the selected time range to the desired location. Once you define the time range, position the mouse inside the selected time range and drag the slider to define the new time range. Similarly, you can define a specific time by clicking on the timeline chart. The time range can be adjusted at any time.

    Note: As you adjust the time range on the timeline chart, the Columns and the Data panels are adjusted automatically for the selected time range.
  • Viewing timeline chart details

    Hover your mouse over any part of the timeline chart to view the time and the number of messages.

    Note: When you use Correlation Bloks in advanced search, hovering your mouse over any part of the chart displays the number of correlation events instead of the message count.
  • Filtering results based on the time range

    You can fine-tune your search results based on the time range. Click the event count (the line that represents the number of events) on the timeline chart or define the time range by zooming in on the timeline chart to view results in the Data panel. A new filter is added for the defined time and the filtered results are displayed on the Data panel.