I'm trying to build a timechart (line graph) over 13 years using a 12 month span.
My search to generate the visualisation looks like this:
sourcetype="ec_com_donations_CSV"| bin _time span=12mon| timechart sum(Value) by Entity_name useother=f limit=6
And produces a line graph (-line) the looks like this:
If I choose a span <= to 1mon the visualisation shows an adjoining line between points, as intended. However, anything > 1mon, like my search above, the lines disappear.
Why is this? I know this can probably be resolved through XML, but can it be done natively in Splunk (am I missing something obvious!)?