Use cont=true and then fix the order of your fields with one of these solutions: https://answers.splunk.com/answers/530376/chart-using-span-logs-does-not-show-the-columns-in.html https://answers.splunk.com/answers/513688/how-to-maintain-the-exact-sequence-of-columns-in-c.html?childToView=513691#answer-513691 (see my unaccepted answer). https://answers.splunk.com/answers/514202/how-to-rename-the-x-axis-points-in-my-chart-from-m.html (see my unaccepted answers). ... View more

Thanks, this works great! ... View more