Using Event Markers to build your Narrative Timeline
Event Markers are the points along your narrative timeline that compose the story of your incident:
Detection event markers tell the story about how participants detected the problem: automates notifications, pages, customer reports, things engineers noticed, etc.
Diagnosis event markers are activities and messages where your identified participants are figuring out what happened: tracking hypotheses, results from diagnostic tests, sharing dashboards and graphs, etc.
Repair event markers tell the story of fixing the problem or minimizing impact: thinking up possible solutions, actions taken to repair, monitoring impacts of the fix, etc.
Key Moment event markers are flexible in definition and use, they help to tell the story of the incident from various changes during response to events that help explain how we got here: planning external comms, starting a Zoom call, a new feature launch, etc.
To add an Event Marker use the “+ Add marker” button in the top right hand corner:
Within each event marker you can add a summary, supporting evidence, notes and the time of the event.
The summary is where you will describe the nature of this event. What makes this important, or how does it change the story of the incident? Keep in mind: this field is the information immediately visible for each event marker in the timeline view.
Supporting Evidence is where you link relevant Slack messages to the marker. You can drag them from the opportunity data side of the screen right into the marker. Supporting evidence for the earliest detection marker in your timeline might be an exchange of messages in a public engineering channel asking about a confusing dashboard, or a single ping in an alerts channel.
✨ Drag and drop events directly into a narrative marker under "Supporting Evidence in the, Narrative Marker Details panel, this will add them as evidence within the marker!
Add Supplemental Evidence You can also add evidence from outside of Slack messages by clicking the "Add supplemental evidence" button. Here you can add images, text, and links to add context to the story of the incident. This might be screenshots of graphs, links to a specific query, or a copy and paste of relevant logs.
Notes are your workspace to track your questions, log your insights, and gather your thoughts. Notes can also be edited from the timeline view as well, so that you can update or add new information as you run interviews or your review meeting.
The time can be set manually down to the second. It is in 24 hour time in your local timezone. For each event you can set a single time, or add an end time to indicate the duration of the effort depicted by this event marker.
You can also check the "Use supporting event evidence to set time" box to automatically set the timeframe of your Marker using the time of your events under "Supporting Evidence"
In the timeline, event markers are represented as a single point in time. If you add an end time to an event, it will show as a continuous line for the duration of the event’s timeframe. If you leave the time blank, the event marker will fall at the end of the narrative timeline and will not be a visual point on the timeline display.
You can go back and edit any of the fields of an event marker from the builder at any time. If you at any point realize the supporting evidence and notes you have added suggest a different type of event marker, you can select a different one from the marker type drop down.
When starting a new investigation, the narrative timeline will show two event markers by default: Opportunity Started and Opportunity ended (pictured below). The time of these markers are set automatically based on the timeframe of the imported Slack messages, but can be customized. These events cannot be deleted or changed to other event marker types.
