Just as an FYI, I find that a chart is typically most readable when the max value is around 3/4 of the Y-scale so you might want to do something like this: <eval token="chartmax">ceiling($result.max_duration$*4/300)*100</eval> ... View more

You could do this: in props.conf [yoursourcetypehere] REPORT-eaf=extract-all-fields in transforms.conf [extract-all-fields] FORMAT = $1::$2 REGEX = (\S+?)\s*:\s*(\S+) This should give you all the field extractions. ... View more

It will return average of your load average.... on second thoughts (and further reading of the documentation!), May be what you need is the xyseries. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xyseries You may have to create a dummy field with the Y-axis label like so: ... | eval y_field = "load_times" | xyseries date_time y_field, load_time I haven't used this but I have a feeling this will suit your case. ... View more