https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415027#M41563 <P>list is not an appropriate function to use over timechart. Try avg or other mathematical aggregation functions</P> <PRE>| timechart avg(NoiceFloor) by APname</PRE> Tue, 22 May 2018 20:02:34 GMT pradeepkumarg 2018-05-22T20:02:34Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415025#M41561 <P>Hi, <BR /> I have the following search and need to make a timechart of NoicerValues by APname. I tried this but there are not results.</P> <PRE><CODE>index="ti-wifi" sourcetype=csv_wifi name=bsnMobileStationMacAddress | rename values as MobileStationMacAddress | join ip [search index="ti-wifi" name=bsnMobileStationRSSI | rename values as MobileStationRSSI ] | join ip [search index="ti-wifi" name=bsnMobileStationSnr | rename values as MobileStationSnr] | join ip [search index="ti-wifi" name=bsnMobileStationAPMacAddr | rename values as MacAddress ] | lookup wifi.csv MacAddress OUTPUT APname | eval MacAddress =APname | eval totalCount = (MobileStationRSSI - MobileStationSnr) | stats sum(totalCount) as totalNoice, count as Sessions by APname | eval NoiceFloor = round(totalNoice/Sessions,0) | timechart list(NoiceFloor) by APname </CODE></PRE> <P>Thank you</P> <P>Ed</P> Tue, 22 May 2018 19:23:33 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415025#M41561 acceo_purchasin 2018-05-22T19:23:33Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415026#M41562 <P>Can you show the results you get when you remove the last part of your search (the <CODE>| timechart ...</CODE>)?</P> Tue, 22 May 2018 19:56:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415026#M41562 xpac 2018-05-22T19:56:46Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415027#M41563 <P>list is not an appropriate function to use over timechart. Try avg or other mathematical aggregation functions</P> <PRE>| timechart avg(NoiceFloor) by APname</PRE> Tue, 22 May 2018 20:02:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415027#M41563 pradeepkumarg 2018-05-22T20:02:34Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415028#M41564 <P>I receive the following table :</P> <P>APname totalNoice Sessions NoiceFloor <BR /> wap-3 -72 1 -72 <BR /> wap-7 -755 8 -94<BR /><BR /> wap-8 -1081 11 -98 <BR /> :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::</P> <P>Best regards</P> Wed, 23 May 2018 12:05:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415028#M41564 acceo_purchasin 2018-05-23T12:05:16Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415029#M41565 <P>Thank you for your answer, I already tried it but I received : Non result found.</P> <P>Best regards</P> Wed, 23 May 2018 12:07:55 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415029#M41565 acceo_purchasin 2018-05-23T12:07:55Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415030#M41566 <P>At this point, your <CODE>stats()</CODE> has already removed all time information, so it's no longer possible to draw a timechart.<BR /> Do you actually want a time chart, that means the values for one or multiple series over a certain time frame? If yes, what time frame would that be?</P> Wed, 23 May 2018 12:24:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-timechart-for-a-search/m-p/415030#M41566 xpac 2018-05-23T12:24:45Z