Use xmlkv to get the values: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xmlkv Then use table or timechart to plot your values. If you choose to go for the timechart option, keep in mind that it operates on timespans so you need to feed it with some statistical function to tell it how to handle any events where multiple values show up in a timespan. For instance you could use avg to just get the average in the unlikely event that two values show up in the same span. More info on timechart : http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart ... View more