The easiest way would simply be to name the file with the date/timestamp in a way that datetime.xml can get the timestamp, assuming the events are all supposed to have the same timestamp. Then, Splunk should extract the date/time from the file name, and auto-increment the extracted time as it finds that it's getting too many repeats. Similarly, if you can manipulate the file, you could prepend a single timestamp at the top of the file and subsequent events lacking a timestamp should get that timestamp. If more than 100,000 events come in for the same host/source/sourcetype in sequence with the same second timestamp, Splunk will auto-increment timestamps by 1 second, specifically to avoid this issue, so either of these solutions should work. ... View more

The bins comment is totally accurate, in that you can use this to raise the maximum number of bins, and thus raise the granularity: | timechart bins=1500 count but i think as you've discovered, there's another limit even after you've fixed that, of 250 rows, and that the flash only seems to graph from the first 250 rows even when there are more. What you're hitting is a 250 row limit on the FlashChart module in the UI itself. If you're authoring in the advanced XML (which you probably are not), the the FlashChart module takes a param called maxResultCount, which is optional and defaults to 250. If on the other hand you're authoring in the simplified XML, you can effect the same thing with a charting key: <option name="charting.data.count">1000</option> add one of those to your <chart> like so <chart> <searchString>foo | timechart bins=1000 count by sourcetype</searchString> <earliestTime>-6h</earliestTime> <latestTime>-0s</latestTime> <option name="charting.chart">line</option> <option name="charting.data.count">1000</option> </chart> And to show the code in the land of the Advanced XML, you would add this param: <param name="maxResultCount">1000</param> to your FlashChart module. Hopefully that will get you going. ... View more