> ## Documentation Index
> Fetch the complete documentation index at: https://radarhq.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Event timeline

> Unified, queryable timeline of cluster events and resource changes. Memory or SQLite storage, scoped per resource or cluster-wide.

![Radar timeline - merged stream of K8s events, resource diffs, and Helm operations with severity filters](https://radarhq.io/images/radar/screenshot-timeline.png)

The Timeline is a chronologically merged log of:

* **Kubernetes events** (`kubectl get events`-equivalent, but searchable)
* **Resource changes** - every observed update, with a diff
* **Pod lifecycle** - container starts, restarts, exits, OOM kills
* **GitOps activity** - Argo / Flux reconciliations and outcomes
* **Helm operations** - install / upgrade / rollback / uninstall events
* **Audit transitions** - when a resource starts or stops failing a check

You can scope it cluster-wide or to a specific resource (drawer → Manifest history).

## Storage backends

```bash theme={null}
# In-memory (default). Cleared on restart. Up to --history-limit events.
radar --timeline-storage=memory --history-limit=10000

# SQLite. Persists across restarts. Path = ~/.radar/timeline.db unless overridden.
radar --timeline-storage=sqlite --timeline-db=$HOME/.radar/timeline.db
```

In-cluster Helm:

```yaml theme={null}
timeline:
  storage: sqlite
  dbPath: /data/timeline.db
  historyLimit: 50000
persistence:
  enabled: true
  size: 5Gi
```

|                   | **Memory**                     | **SQLite**                      |
| ----------------- | ------------------------------ | ------------------------------- |
| Survives restart  | No                             | Yes                             |
| Disk required     | No                             | Yes (PVC for in-cluster)        |
| Best for          | Local dev, ephemeral debugging | Shared in-cluster install       |
| `--history-limit` | Hard cap                       | Used as a soft retention budget |

## Filtering

* **Resource scope** - cluster, namespace, or single resource.
* **Kind / verb** - changes vs. events, by API kind.
* **Severity** - normal / warning / error.
* **Search** - free text across reason / message / object name.
* **Time range** - last 5 min / 1 h / 24 h / 7 d / custom.

## Diff view

For resource changes, the timeline shows a structured diff (added / removed / changed fields). Click `</>` to flip to a raw YAML diff. Field-level filters let you suppress noise like `metadata.managedFields` or `status.observedGeneration`.

## Why "what happened last Tuesday" gets easy

Standard `kubectl get events` only retains \~1h of cluster events and gets cleared whenever an apiserver pod restarts. Radar's timeline doesn't suffer from that:

* **Memory mode** retains up to `--history-limit` events as long as the Radar process runs.
* **SQLite mode** survives restarts, scaling, and cluster maintenance.
* **Resource diffs** aren't in `kubectl events` at all - Radar synthesizes them by watching every resource via informers.

## Events vs. changes

|                 | **Event**                   | **Change**                                 |
| --------------- | --------------------------- | ------------------------------------------ |
| Source          | K8s `Event` resource        | Informer diff between two ResourceVersions |
| Lifetime in K8s | \~1h, ephemeral             | Until the resource is deleted              |
| In Radar        | Stored, indexed, searchable | Stored, indexed, with diff                 |

## See also

* [Resource browser](/docs/features/resources) - the per-resource Manifest history tab uses the same backend.
* [In-cluster deployment](/docs/configuration/in-cluster) - persistence for SQLite.
* [CLI flags](/docs/configuration/cli) - `--timeline-storage`, `--timeline-db`, `--history-limit`.