> For the complete documentation index, see [llms.txt](https://docs.portainer.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.portainer.ai/portainer-command/using-portainer-command/admin/timeline.md).

# Timeline

**Timeline** shows everything that has happened on the instance, newest first: sessions issued and ended, connections created and revoked, workspaces provisioned and destroyed, proposals opened and decided, and environment configuration changes. It's the first page under **Administration**, because it answers the question you usually arrive with: what happened?

Click any event for its full record.

<figure><img src="https://1938785147-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fypmd3gtxKLcOeVHnIvOD%2Fuploads%2FpjmFGIMUCC6EaY4VE7vv%2Fcommand-timeline-1.png?alt=media&amp;token=92deff7c-4278-4a6b-89d7-62ac446a7130" alt="Timeline activity feed"><figcaption></figcaption></figure>

## Filter the timeline

| Filter          | Overview                                                                                                              |
| --------------- | --------------------------------------------------------------------------------------------------------------------- |
| Search activity | Free-text search across events.                                                                                       |
| Date range      | Limits events to a range of days, in your local time zone. Defaults to **Any time**.                                  |
| User            | Shows events for one user.                                                                                            |
| Kind            | Shows one kind of activity: **Sessions**, **Connections**, **Workspaces**, **Proposals**, or **Environment changes**. |

Click **Show older** at the bottom of the feed to load more events.

## Export the timeline

Click the download icon (**Download as CSV**) to export every event that matches the current filters. This is useful for incident reviews or for handing activity records to a security team.