This is probably a really simple question but I have events coming in every minute.
I've used | rex field=_raw .... to extract a field from those events.
How do I plot these field values over time?
This is what my statistics look like.
| timechart span=1m values(Last_Heartbeats)
but nothing shows up on my line graph. I've also tried it without a span, I've tried | stats with a | bucket command, I've tried dc(Last_Heartbeats) but I can't figure it out.