Using the timeline and summarization charts

Viewing the timeline chart

When you perform a search, by default a timeline chart followed by a list of log entries is displayed. This chart depicts how your search results are distributed over the time context specified. The x-axis of the chart represents the time range, which depends on the time context that you specified, while the y-axis represents the count of the search results. For example, if you performed a search for the last 7 days, you can see bars displaying the search result count for the last 7 days from today. Moving the mouse pointer on a bar displays the time and the total count of the search results.

To view the timeline chart, click the Search tab, specify an appropriate search criteria in the search bar, and click Search. For more information about performing a search, see Getting started with search.

You can change the time context of your search by using the timeline chart, as follows:

• Click one of the bars in the chart to drill down into your search results.
  For example, if your search results are summarized on a monthly basis, click one of the bars to drill down into the results on a weekly basis, and then further click one of the bars to drill down into the results on a daily basis, and so on.
• Move the slider handles under the timeline chart to select a time range and click Search. This helps you easily select a custom time range and see the corresponding search results.
  You can reset the slider by clicking Reset Slider so that the chart is reset to the original time context (this means the current search query that was run).
  For example, supposing you have performed a search for the last 7 days. Now you want to take a closer view to see how the chart changes for the third and the fourth day in the last 7 days time range. To do this, you can adjust the slider handles on the left and the right to select the third and the fourth day and click Search.
• Use the Shift time context to previous  and Shift time context to next  on the top of the timeline chart to browse through the search results before and after the time range specified.
  The time gap used for shifting the time context depends on the initial time range specified for performing the search.
• Compare the timeline chart across different time contexts. To do this, click the three vertical dots (indicating a menu) on the All Data tab, select Compare, select one of the compare options, and then click Compare. For more information, see Viewing search results.

The following figure displays a summary of the search results in the form of a timeline chart, which is followed by a series of actual search results:

Timeline chart with search results (in the Table View)

Viewing the summarization chart

The summarization chart displays a summary of your search results in the form of various kinds of charts, for example, bar diagram, pie chart, line chart, and so on. You can summarize your search results for a particular field. By default, a bar diagram is displayed for the default HOST field. Moving the mouse pointer on the chart displays the particular value (search result) along with the total count indicating the recurrence of that value. A table displaying all values along with a total count for each value is displayed next to the chart. 

To view the summarization chart, proceed as follows:

1. Perform a search on the Search tab. For more information, see Getting started with search.
2. Under the timeline chart, click Chart View .
3. Select a field or tag name from the Summarization field list.
4. Select one of the following options from the Chart type list and click Apply:
   

   Chart type	Preview
   Bar
   Column
   Doughnut
   Line
   Pie

By default, the legend is displayed. To hide the legend, clear the Show Legend check box.

The following figure displays the summarization chart which is available under the timeline chart:

Summarization chart (bar diagram)