Hi everyone I have problem with visualising the graph with my data.
Here's my example that works fine because I guess the time range is the same (date + time) while my actual log data on Splunk is just the date.
| makeresults
| eval raw="10, 2, typeA, 2022-05-29T20:12:50.000-07:00|11, 3, typeB, 2022-05-29T15:10:26.000-07:00|5, 1, typeB, 2022-05-29T03:08:34.000-07:00"
| makemv raw delim="|"
| mvexpand raw
| rex field=raw "^(?<processed>[^,]+),(?<failed>[^,]+),(?<release>[^,]+),(?<_time>[^,]+)$"
| chart values(processed), values(failed) over _time by release
| bin span=1d _time
So in this example the "typeB" for the same date contains 2 values "11" and "5". When you go to visualise this graph (Column graph) it works fine, I see 2 columns with with values 11 & 5. But in my actual data in Splunk when I run
| chart values(processed), values(failed) over _time by release
| bin span=1d _time
I'm getting only the date Screenshot so the values overlap overlapping screenshot like so.
Any idea how to split this column into 2 (or more based on the number of values for that column)?
Edit: This is the _time from my data in Splunk 
and this is the _time from the example data 
