Although specifying an aggregation function to make the x-axis of the data table continuous and uniform with one data point for each of fewer than a few hundred points is a strong, strong suggestion, it's not essential when charting. As long as you provide a table to our charting subsystem to render individual time points, provided that there are fewer than 250 of them (any more will be discarded). Assuming that you have a search that yields events with timestamps and the values of these metrics, you can add to your search and click on "Show report":
... | table _time rmi_time persist_time
Only the most recent 250 data points will be shown in this chart.
In any given time interval, there may be more than one value of
rmi_time, and a graphed series will only be able to display one point for that interval. Therefore, you must specify an aggregation function, i.e., how to resolve having potential multiple values in an interval.
If you know ex ante that your chart and intervals will only ever contain at most one value, then you can simply use e.g.,
first(rmi_time) as rmi_time, (or any of
median() etc. for numeric data).
When you chart over time the values will likely be put into bins. In most situations, when charting those types of values you describe, using avg is the easiest. You could also use the first or last function.