3.5 Using the Timeline

Splunk Core Certified User Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path

2 Splunk Basics

2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation

3 Basic Searching

3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results

4 Using Fields in Searches

4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar

5 Search Language Fundamentals

5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort

6 Using Basic Transforming Commands

6.1 The top Command 6.2 The rare Command 6.3 The stats Command

7 Creating Reports and Dashboards

7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards

8 Creating and Using Lookups

8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches

9 Creating Scheduled Reports and Alerts

9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts

3.5 Using the Timeline

Key Takeaways Explain This Topic AI

The Splunk timeline is an Events-tab histogram of event counts per time bucket; bar height shows volume and the legend shows bucket width (for example, 1 hour per column).

Peaks indicate activity spikes and valleys or empty columns indicate density gaps that may signal downtime, quiet periods, or overly narrow filters.

Selecting bars and choosing Zoom to Selection filters the Events list and updates the Time Range Picker; after zooming, widen again with Zoom Out or the picker—not Deselect.

Timeline format options (Compact/Full, linear/log) change display only; the smallest zoom granularity is 1 millisecond.

Last updated: August 2026

3.5 Using the Timeline

Quick Summary: The timeline in the Splunk Search & Reporting app is a bar-chart histogram that shows how many matching events fall into each time bucket across your search window. Peaks reveal activity spikes; valleys or empty columns reveal density gaps . Zooming, panning, and selecting time slices refine the Time Range Picker and the Events list without rewriting your SPL.

After you run a non-transforming search, Splunk returns raw events on the Events tab. Directly above that event list sits the timeline—one of the highest-value investigation tools tested in Basic Searching (22%) of the Splunk Core Certified User exam. Mastering the timeline means you can visually spot when something happened, zoom into that window, and filter the event list to only those moments.

What the Timeline Shows

The timeline is a visual representation of event count over time . Each vertical bar (column) represents a time bucket. The height of the bar is the number of events whose _time values fall inside that bucket.

Timeline Element What It Means Exam Cue
Bar height Count of matching events in that time slice Hover a bar to see the exact count
X-axis Time progressing left → right Older events on the left; newest on the right
Y-axis Event volume (Full format only labels it clearly) Linear by default; log scale optional
Legend Bucket width (for example, "1 hour per column") Changes when you zoom in or out
Peak (spike) Sudden increase in matching activity Often an incident, deploy, or traffic surge
Valley / gap Low or zero matching events Possible downtime, outage, or over-filtering

Hover any bar to preview the event count for that slice. Clicking a single bar drills the view into that bar’s time range so the Events list updates immediately.

Note

The timeline appears for event searches on the Events tab. Once a transforming command (such as stats , top , or timechart ) converts events into a statistics table, you work primarily on the Statistics or Visualization tabs—the classic event timeline is an Events-tab investigation tool.

Timeline Format Options

Above the timeline, Splunk exposes format controls that change how the histogram is drawn—not which events are returned.

Compact vs Full

Compact (default): A shorter chart that maximizes room for the Events list. Ideal for routine browsing.

Full: A taller chart with clearer axis labels (count on the Y-axis, time on the X-axis). Use Full when you need to read density differences carefully.

Linear vs Log Scale

Linear scale (default): Bar height is proportional to event count. Best when volumes are similar across buckets.

Log scale: Compresses large peaks so smaller activity remains visible. Useful when one spike dominates the chart and hides smaller patterns.

Changing format does not change the underlying search results—only how density is displayed.

Zoom, Pan, and Select Time Slices
Zoom Out and Zoom In

Controls above the timeline include Zoom Out (and, depending on state, zoom-in via selection or the Time Range Picker).

Zoom Out widens each column’s time unit. Example: legend changes from 1 hour per column to 1 day per column .

Zooming out also updates the Time Range Picker to the broader window.

Zoom In toward finer granularity by selecting bars and choosing Zoom to Selection , or by narrowing the Time Range Picker.

The smallest time unit you can zoom into is 1 millisecond .

Zoom to Selection (Filter by Time Slice)

This is the action most frequently tested conceptually:

Click one bar, or click-and-drag across a cluster of bars.

The Events list temporarily shows only events inside the selected slice; the Time Range Picker reflects that selection.

Choose Zoom to Selection to commit the filter: timeline and Events list redraw for only that period.

Choose Deselect to cancel a pending selection before you zoom.

After you zoom to a selection, Deselect is no longer available . To widen again, use Zoom Out or change the Time Range Picker (for example, return to All time or Last 24 hours ).

Resetting the Timeline

If you started with All time , zoomed out, then want the original scale back, re-select the original preset in the Time Range Picker. The picker and timeline stay synchronized—treat the picker as the source of truth for the active window.

Reading Density Gaps and Investigation Patterns

A density gap is a stretch of empty or near-empty bars between populated regions. Gaps are not always “good news” (quiet systems). In exam scenarios and real work, gaps often mean:

A host stopped sending logs (forwarder or network failure).

An application was offline, so no matching transactions occurred.

Your search terms are so narrow that only intermittent matches exist.

Day/night or weekend patterns create expected low periods.

Practical investigation workflow:

Run a broad keyword or sourcetype= search over a generous window (for example, Last 7 days).

Scan the timeline for unexpected peaks and gaps .

Select the anomalous bars → Zoom to Selection .

Inspect events, Selected Fields, and surrounding context (covered in the next section).

Optionally add field filters from the Fields sidebar to confirm the spike’s cause. Example timeline reading (web 503 errors, Last 7 days):

Mon Tue Wed Thu Fri Sat Sun
||| ||| |||||||| ||| ||| || |
^peak
^gap overnight Thu→Fri

Action: drag-select the Thu peak → Zoom to Selection → review status=503 events.

Timeline vs Time Range Picker vs SPL Time Modifiers

Keep these three mechanisms distinct:

Mechanism Primary Purpose Side Effect

Time Range Picker Declares the search’s earliest/latest window before or while searching Limits which index buckets Splunk opens

Timeline zoom/select Visually narrows an already-running (or completed) result set’s display window Updates picker + Events list to the selected slice

SPL earliest= / latest= Hard-codes time in the search string Overrides or pairs with picker settings depending on usage

Exam tip: selecting timeline bars is a UI refinement technique . It does not invent new data; it filters the time window of results you already retrieved (or re-scopes the job’s display to that range).

User-Level Best Practices

Prefer a sensible picker range first (Last 15 minutes / Last 24 hours) rather than All time, then use the timeline to zoom further.

Use Full + linear for teaching yourself patterns; switch to log scale only when a single spike hides everything else.

Treat empty columns as hypotheses (outage vs over-filter), not conclusions—always open events after zooming.

Remember: timeline skills belong to domain 2.5 Use the timeline ; they complement—not replace—Boolean and field refinements from topics 2.1–2.4.

When you can glance at a histogram, name the spike, zoom to it, and explain what the Events list should show next, you have met the User-level timeline objective.