When I do a timechart - I get the max of my variable in the chart.
However, if I hover over the value - the time associated is the bin time of the timechart and not the actual time of the event.
i.e. for a 24 hour search
timechart max(latency) span=30m
If I had an event measuring 1500 at 10:37:45 which was the max in that bin, it will chart 1500, but it will timestamp at 10;30, the beginning of the bin.
How do I get it to show the actual event _time ?
Give this a try
your base search
| eventstats max(latency) as max
| eval MaxTimestamp=if(latency=max,_time,null())
| timechart span=30m max(latency) as maxLatency values(MaxTimestamp) as MaxTimestamp values(max) as max
| appendpipe [| dedup MaxTimestamp max | eval _time=MaxTimestamp | eval maxLatency =max ]
| table _time maxLatency | sort _time