I found a trap with the playback feature that took me a day to figure out. Posting here to help others.
Problem
My data was rendering the track correctly, the playback markers where appearing, playback timer and slider were responding to the Start and Stop button, but the markers would not move.
Solution
My table of data was ordered from youngest to oldest which is how splunk search works by default. By adding | reverse
to my search the data was ordered from oldest to youngest. After that the markers moved 🙂
