- Search Overview
- Search Home Page
- Performing Searches
- Basic Search
- Advanced Search
- Advanced Search Building Blocks
- Running an Advanced Search Query
- Query Syntax
- Query by Subject
- Query by Vendor and Product
- Query by Field and Value
- Query by Context Table
- Query Using Regex
- Free Text Search
- Query Using Advanced Query Language Operators
- Query Using Aggregation Functions
- Query Using Structured Fields
- Dynamic Field Extraction
- Natural Language Search
- Anomaly Search
- Refine a Search
- Context Tables in Search
- Search Best Practices
- Search Results
- Dashboard Visualizations
Timeline View of Search Results
On the Search home page, below the total number of results, is a graphical representation of the results.
The Timeline View is a date histogram bar graph that shows the count of events over the selected time range, matched by the search and time filters. The histogram lists the time range you’re currently exploring, as well as the interval range that is being used.
Note
If an event does not specify a timezone, the time is reported in UTC.
Note
To accommodate very large log data volumes, the timeline, by default, initially displays only the last 2 weeks. Click the Fetch more icon to continue building out the Histogram.
The time range associated with each column dynamically adjusts based on the time range of your search. Each column may represent minutes, hours, or days in the timeline depending on how wide the search range.
Note
Click Hide Timeline/Show Timeline to hide or display the Timeline View.
To narrow the time filter from the histogram:
Click the individual the bar that represents the time interval you want to zoom in on, OR click and drag to view a specific timespan.
Click the Zoom selection icon () to zoom in on the selected time interval.
Click the icon to revert the timeline back to the original time frame.