Querying raw data point for 24hr window time chart not displaying all values?

[jaj]

source= "KeyOfThis" | table theRawValue, _time | chart values(theRawValue) by _time

So, when I run this query there is an event with a large Raw value for a given date that I need to display (and for any large value that looks out of control). I can get this data value to show up in my line graph within 15min timeframe. However, when I try to fit it within the last 8hrs (let alone the last 24hrs) for that same chart the value doesn't show up because there is too much data to display apparently as the day/month for that data point is not showing up. The date range is short by two days so that value is not showing up in the chart.

How can I display all the raw values within an 8hr or 24hr time frame without having to average?

[lguinn2 · Accepted solution]

Splunk is not going to be able to display that many data points. Plus, I don't think that the values function what you want. However, one way to show fewer points is to only show the large values, perhaps like this

source=<source.log> "KeyOfThis"
| timechart span=5m max(theRawValue)

Which will show the maximum value seen in each 5 minute period.