Data formatting

... | table _time <resource_field> [<duration_field>] [<color_field>] [<tooltip_field>]

Generate a timeline

1. Select the Add chart button ( ) in the editing toolbar and browse through the available charts. Choose the timeline.
2. Set up a new data source by selecting + Create search and adding a search to the SPL query window. Or, you can select an existing data source under the Search, Saved search, or Chain search sections.
3. (Optional) You can also write a new ID that describes the search better than the default by changing the ID in Data source name.
4. Select Apply and close.

Configuration Panel options for timelines

Title

Give your visualization a name. The title name is also helpful when searching for individual visualizations in the dashboard definitions and is not the same as the automatically assigned unique ID.

Description

Give your visualization a description to explain what the user is viewing.

Data sources

Choose an existing search or create a new one.

Visibility

Optionally hide the visualization when data is unavailable and configure custom visibility conditions.

Position and size

You can use your cursor or the Position and size section of the Configuration panel to change the size or location of the visualization for pixel-perfect sizing and placement.

Data configurations

• Select the X list to pick the field for the visualization x-axis.

• Select the Y list to pick the field for the visualization y-axis.

• Select the Duration list to pick the field that defines event duration. Events with a duration display as bars instead of circles.

• Select the Category list to pick the field that assigns categories to events. The visualization colors the events based on their category.

• Select the Additional Tooltip Fields list to pick extra fields to display in tooltips. These fields and their values show when hovering over events in addition to the default tooltip information.

Data display

Select the Lane label width setting to specify the width in pixels for y-axis labels.

Color and style

Use drilldown to create interactivity with the different map layers. For example, with drilldown, users can click on a bubble to set a token which you can use to open a secondary search using the clicked values. For more details about setting tokens, see Setting tokens on a visualization click.

Source code

Select your visualization or its search to view and edit the source code in real time. You can also change the Visualization ID to a more readable ID to help identify this visualization in the source code.

Timeline example

{
    "dataSources": {
        "primary": "ds_ZDwPn84c"
    },
    "options": {
        "backgroundColor": "transparent",
        "category": "> primary | seriesByName('attack_type')",
        "legendDisplay": "right",
        "dataColors": "",
        "seriesColors": [
            "#7B56DB",
            "#009CEB",
            "#00CDAF",
            "#DD9900",
            "#FF677B",
            "#CB2196",
            "#813193",
            "#0051B5",
            "#008C80",
            "#99B100",
            "#FFA476",
            "#FF6ACE",
            "#AE8CFF",
            "#00689D",
            "#00490A",
            "#465D00",
            "#F6540B",
            "#FF969E",
            "#E47BFE"
        ]
    },
    "title": "Attack Types by Network Segment Over Time",
    "type": "splunk.timeline",
    "containerOptions": {
        "description": {
            "color": "#000000"
        },
        "title": {
            "color": "#000000"
        }
    },
    "context": {
        "dataColorConfig": [
            {
                "to": 20,
                "value": "#D41F1F"
            },
            {
                "from": 20,
                "to": 40,
                "value": "#D94E17"
            },
            {
                "from": 40,
                "to": 60,
                "value": "#CBA700"
            },
            {
                "from": 60,
                "to": 80,
                "value": "#669922"
            },
            {
                "from": 80,
                "value": "#118832"
            }
        ]
    },
    "showProgressBar": true,
    "showLastUpdated": false
}

Source options for timelines