Group by Multiple - TimeChart Question

richardphung — Fri, 12 Jun 2020 16:42:04 GMT

Greetings---

I have Wireless logs that I am attempting to create a Timechart, splitting by Area, and displaying stacked by AccessPoint.

Here is my base search:

index="wlan" EventType=Authentication | rex field=AP (?<=AP-)(?<area>.*?)(?=-) | eval area = upper(area)

Ideally, I would like to create a Trellis of ...

| timechart dc(Mac) AS count by AP

grouped by the field area.

I see loads of examples on answers... this is the closest that I get:
https://community.splunk.com/t5/Splunk-Search/Timechart-count-by-ip-by-fw-name-over-time-with-trellis/m-p/498737

So with this, I get..

index="wlan" EventType=Authentication | rex field=AP (?<=AP-)(?<area>.*?)(?=-) | eval area = upper(area) | bucket span=30m _time | stats dc(Mac) AS count by _time area AP | eval {AP}=count | fields - AP count

Which is VERY close..
My trellis is grouped by area, and it displays my bar chart over time.
However, it 1) does not support stacking, and 2) does not seem to filter the legend...
in my case, I have around 10 areas and 160 APs., and each chart in the trellis by area displays correctly, but it also displays the all 160 APs in the legend space per chart.

Any help is appreciated.

topic Group by Multiple - TimeChart Question in Reporting

Group by Multiple - TimeChart Question