Timeline View
The timeline view shows all kernel events and financial events on a single horizontal timeline, across all services and nodes simultaneously. It is the best view for understanding the exact sequence and timing of events.
Layout
The timeline is organized into horizontal swimlanes, one per service or kernel component:
- Each service gets its own swimlane showing its financial events (payments received, writes initiated, responses sent)
- Kernel swimlanes show raw eBPF events per node, broken down by event type
Events appear as blocks on the timeline. The width of each block represents its duration. Hover over any block to see full event details.
Zoom levels
The timeline supports five zoom levels:
| Level | Resolution | Best for |
|---|---|---|
| Overview | 100ms per division | Full transaction flow |
| Default | 10ms per division | Service-level latency |
| Detail | 1ms per division | Individual operations |
| Fine | 100µs per division | Kernel event timing |
| Nanosecond | 1µs per division | Precise scheduling analysis |
Use the scroll wheel to zoom, or use the zoom controls in the top right corner. The timeline will center on whatever section you are currently viewing.
Correlation lines
When you hover over an event in any swimlane, the timeline draws vertical correlation lines connecting it to all causally related events in other swimlanes. This makes it immediately visible which kernel event in the bottom swimlanes corresponds to the latency spike in the service swimlane above.
Selecting a time range
Click and drag on any part of the timeline to select a time range. This:
- Zooms the view to that range
- Filters the causal graph view to only show events within the range
- Shows aggregate statistics for the selected range in the stats panel
Live mode
When viewing current activity (not a historical incident), the timeline can run in live mode. The timeline scrolls automatically as new events arrive via WebSocket. Toggle live mode with the button in the top right corner.
Live mode is useful during active incident investigation — you can watch the kernel event stream in real time as you make changes to the system.
Exporting timeline data
The selected time range can be exported as a CSV of all events for offline analysis. The CSV includes all fields: timestamp (nanoseconds), PID, TID, CPU, event type, duration, and financial context.