Dashboards & Visualizations

How to make a timechart for a search?

acceo_purchasin
Explorer

Hi,
I have the following search and need to make a timechart of NoicerValues by APname. I tried this but there are not results.

index="ti-wifi" sourcetype=csv_wifi name=bsnMobileStationMacAddress
| rename values as MobileStationMacAddress
| join ip
   [search index="ti-wifi" name=bsnMobileStationRSSI
   | rename values as MobileStationRSSI ]
| join ip
   [search index="ti-wifi" name=bsnMobileStationSnr
   | rename values as MobileStationSnr]
| join ip
   [search index="ti-wifi" name=bsnMobileStationAPMacAddr
   | rename values as MacAddress ]
| lookup wifi.csv MacAddress OUTPUT APname
| eval MacAddress =APname
| eval totalCount = (MobileStationRSSI - MobileStationSnr)
| stats sum(totalCount) as totalNoice, count as Sessions by APname
| eval  NoiceFloor = round(totalNoice/Sessions,0)
| timechart list(NoiceFloor) by APname

Thank you

Ed

Tags (1)
0 Karma

pradeepkumarg
Influencer

list is not an appropriate function to use over timechart. Try avg or other mathematical aggregation functions

| timechart avg(NoiceFloor) by APname
0 Karma

acceo_purchasin
Explorer

Thank you for your answer, I already tried it but I received : Non result found.

Best regards

0 Karma

xpac
SplunkTrust
SplunkTrust

Can you show the results you get when you remove the last part of your search (the | timechart ...)?

0 Karma

acceo_purchasin
Explorer

I receive the following table :

APname totalNoice Sessions NoiceFloor
wap-3 -72 1 -72
wap-7 -755 8 -94

wap-8 -1081 11 -98
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Best regards

0 Karma

xpac
SplunkTrust
SplunkTrust

At this point, your stats() has already removed all time information, so it's no longer possible to draw a timechart.
Do you actually want a time chart, that means the values for one or multiple series over a certain time frame? If yes, what time frame would that be?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...