When doing an investigation on two different alerts. The co-ordinates timeline doesn't show any events in one case but does for the other.
The case of events showing the event source is from our firewall syslog and the events not showing is from our proxy server using CEF logs.
Do you have the "All Meta Keys Must Exist in an Event" option selected?
If so, I believe that will prevent a path from displaying unless it has a meta value present in every meta key that you have selected for your display.
