I have a search which matches multiple values and produces two events as a list. I'd like to basically make it so that the values in eventA are the X axis, the values in eventB are the Y axis, and as more events are found they sum on eventB, grouped by their values in eventA. I basically have rows in my log which look like: timestamp some text some text: [2s,189] [5s,23] [10s,13] [20s,3] [30s,0] This is an example of the events my search is finding: desiredBucket: 2s 5s 10s 20s 30s desiredValue: 189 23 13 3 0 I can't get this to chart with the following X, Y pairings: [2s, 189] [5s, 23] [10s, 13] [20s, 3] [30s, 0] But instead, I'm getting things like this: [2s, 228] [5s, 228] [10s, 228] [20s, 228] [30s, 228] when I try to chart using chart sum(desiredValue) by desiredBucket I understand why this is happening but I can't seem to find a way to get Splunk to identify my desired associations. Help? ... View more