Documentation Grafana Cloud Alerts and IRM IRM Use Incident management Incident timeline

Use the incident timeline in Grafana IRM

The incident timeline serves as a chronological record of all activities, observations, and decisions made during an incident. It provides a single source of truth that helps responders collaborate effectively and enables post-incident analysis.

This topic explains how to use the timeline to document incident progress, share critical information, and maintain a comprehensive incident record.

About the incident timeline

The Grafana IRM incident timeline:

• Captures key events, actions, and observations chronologically
• Integrates with Slack, allowing you to add Slack messages to the timeline using the robot emoji reaction and use Slack commands to update the incident without leaving Slack
• Connects with Grafana Cloud observability data, including dashboards and data sources like Prometheus and Loki
• Displays dashboard panels for visual context
• Supports quick navigation and filtering of incident activities
• Enables easy information sharing among all incident responders
• Creates a permanent record for post-incident review and analysis

All items added to the timeline are timestamped automatically, creating a detailed history of the incident from start to resolution.

Add content to the timeline

You can add several types of content to the incident timeline to document the incident and provide context for other responders.

Add notes

Notes allow you to document observations, decisions, and actions during an incident:

1. Navigate to the incident details page.
2. Select the Text tab.
3. Enter your note in the text field.
4. Click Add note to publish the note to the timeline.

Add queries

Adding queries to the timeline provides data context and helps track metrics related to the incident:

1. Navigate to the incident details page.
2. Select the Query tab.
3. Select a data source.
4. Enter your query in the query editor.
5. Click Run query to execute and verify the query.
6. Add a descriptive title and optional description to provide context.
7. Click Add query to publish the query and its results.

Example queries

Prometheus query example (HTTP error rate):

Copy

sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m])) * 100

Loki query example (error logs):

Copy

{app="myapp"} |= "error" | logfmt

Add dashboard panels

Visualizations from your dashboards can provide critical context:

1. Navigate to the incident details page.
2. Select the Panel tab.
3. Search for and select the dashboard containing the relevant panel.
4. Select the specific panel you want to add.
5. Add a descriptive title and optional description explaining the panel’s relevance.
6. Click Add panel to include it in the timeline.

React to timeline entries

You can add emoji reactions to timeline entries to highlight important information:

1. Hover over any timeline entry.
2. Click the Add reaction (smile face) icon.
3. Select an emoji from the picker.

Common emoji reactions and their typical uses:

Navigate and filter the timeline

As incidents progress, the timeline can grow lengthy. Use these tools to focus on relevant information:

Filter timeline content

To filter the timeline:

1. In the timeline view, locate the filter controls at the top.
2. Filter by:
   • Importance: Select Highly relevant activity, All relevant activity, or All activity
   • Time range: Specify an absolute or relative time range
   • Reactions: Filter for activities with specific emoji reactions

Search the timeline

To search for specific content in the timeline:

1. Use the search field at the top of the timeline.
2. Enter keywords related to the content you’re looking for.
3. The timeline will display only entries matching your search terms.

Jump to specific points in time

To navigate to a specific point in the incident:

1. Use the time range filter at the top of the timeline.
2. Set an absolute time range (specific start and end times) or a relative range (last 30 minutes, last hour, etc.).
3. Click Apply to filter the timeline to that specific period.

Use the timeline for post-incident analysis

The incident timeline is a valuable resource for post-incident reviews and analysis:

1. After incident resolution, navigate to the incident details page.
2. Review the complete timeline to understand the incident’s progression.
3. Use filters to focus on key decision points and significant actions.
4. Identify patterns in the incident response process:
   • When was the incident first detected?
   • How long did it take to engage the right stakeholders?
   • What troubleshooting steps were most effective?
   • Were there any communication gaps?
5. Use these insights to improve your incident response processes.

Best practices for timeline documentation

For effective timeline usage:

• Document events in real-time as the incident unfolds
• Use consistent formatting for similar types of entries
• Capture key metrics at critical points in the incident
• Use emoji reactions to highlight important information
• Clearly indicate who is taking which actions
• Document external communications and stakeholder updates
• Note when significant phases of the incident begin and end

Related documentation

• Declare an incident
• Add and manage incident participants
• Manage incident tasks