If scatter is not working, you could try a workaround: set the lines to transparent and show the markers! save a line-chart report out of your search create a new dashboard and put the report into it edit the dashboard xml then under the <chart> element (simplified xml mode) ... Insert the following (charting reference in this guide😞 <option name="charting.chart.showMarkers">true</option> <option name="charting.chart.markerSize">3</option> <option name="charting.chart.lineStyle.alpha">0</option> If this is now working, try to go to advanced xml mode (instructions here). Then under the <module name="HiddenChartFormatter"> <param name="charting.chart">line</param> put (beware the tags names are different!): <param name="charting.chart.showMarkers">true</param> <param name="charting.chart.markerSize">3</param> <param name="charting.chart.lineStyle.alpha">0</param> Save the dashboard, click on the "Splunk" image top-left to reload them, select your dashboard/view from the menu. Here's a sample result ... View more

Nm, I was being dumb and hadn't selected the field under "Pick Fields." PEBCAK 🙂 ... View more

I ended up resolving this today. I tried to get the prior solution to work however it wasn't quite functioning. After a closer look at the data that was coming in, there was another start time field that I could use. I verified that it matched the time in the event ID. Then I simply created a prefix which skipped x fields in (in this case, x=8). Here's how things look in my props.conf: [AS_CDR] TIME_PREFIX=(?i)^(?:[^,]*,){8}(?P<FIELDNAME>[^,]+) TIME_FORMAT=%Y%m%d%H%M%S.%q%Z ... View more