This is probably a really simple question but I have events coming in every minute.
I've used | rex field=_raw .... to extract a field from those events.
How do I plot these field values over time?
This is what my statistics look like.
I've tried
| timechart span=1m values(Last_Heartbeats)
but nothing shows up on my line graph. I've also tried it without a span, I've tried | stats with a | bucket command, I've tried dc(Last_Heartbeats) but I can't figure it out.
See that your numbers in that column are left justified - that's always a good indicator that Splunk does not think they are numbers, so @isoutamo 's reply is likely to fix your problem
Are you sure that those Last_Heartbeats are numbers? If not then use
eval Last_Heartbeats = tonumber (trim(Last_Heartbeats))
r. Ismo