Timeliner for a data fabric service system

A method comprising:

• receiving, by a search service system, an indication of a request for a timeline visualization received by a data intake and query system;
• creating, by the search service system, a plurality of buckets for search results that correspond to a search query to a plurality of distributed data systems based on a number of partitions from which the search results are collected;
• collecting, by the search service system, the search results obtained from the partitions into the plurality of buckets in time-order based on a timestamp associated with the search results;
• and
• transferring, by the search service system, one or more search results of the search results from the plurality of buckets to the data intake and query system, wherein the data intake and query system associates the one or more search results to one or more interactive bins and causes a display to display the one or more interactive bins in the timeline visualization.

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• receive an indication of a request for a timeline visualization received by a data intake and query system;
• create a plurality of buckets for search results that correspond to a search query to a plurality of distributed systems based on a number of partitions from which the search results are collected;
• collect the search results obtained from the partitions into the plurality of buckets in time-order based on a timestamp associated with the search results;
• and
• transfer one or more search results of the search results from the plurality of buckets to the data intake and query system, wherein the data intake and query system associates the one or more search results to one or more interactive bins and causes a display to display the one or more interactive bins in the timeline visualization.

A non-transitory computer-readable medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• receiving an indication of a request for a timeline visualization received by a data intake and query system;
• creating a plurality of buckets for search results that correspond to a search query to a plurality of distributed data systems based on a number of partitions from which the search results are collected;
• collecting the search results obtained from the partitions into the plurality of buckets in time-order based on a timestamp associated with the search results;
• and
• transferring one or more search results of the search results from the plurality of buckets to the data intake and query system, wherein the data intake and query system associates the one or more search results to one or more interactive bins and causes a display to display the one or more interactive bins in the timeline visualization.