Hi,
I have the following search and need to make a timechart of NoicerValues by APname. I tried this but there are not results.
index="ti-wifi" sourcetype=csv_wifi name=bsnMobileStationMacAddress
| rename values as MobileStationMacAddress
| join ip
[search index="ti-wifi" name=bsnMobileStationRSSI
| rename values as MobileStationRSSI ]
| join ip
[search index="ti-wifi" name=bsnMobileStationSnr
| rename values as MobileStationSnr]
| join ip
[search index="ti-wifi" name=bsnMobileStationAPMacAddr
| rename values as MacAddress ]
| lookup wifi.csv MacAddress OUTPUT APname
| eval MacAddress =APname
| eval totalCount = (MobileStationRSSI - MobileStationSnr)
| stats sum(totalCount) as totalNoice, count as Sessions by APname
| eval NoiceFloor = round(totalNoice/Sessions,0)
| timechart list(NoiceFloor) by APname
Thank you
Ed
list is not an appropriate function to use over timechart. Try avg or other mathematical aggregation functions
| timechart avg(NoiceFloor) by APname
Thank you for your answer, I already tried it but I received : Non result found.
Best regards
Can you show the results you get when you remove the last part of your search (the | timechart ...
)?
I receive the following table :
APname totalNoice Sessions NoiceFloor
wap-3 -72 1 -72
wap-7 -755 8 -94
wap-8 -1081 11 -98
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Best regards
At this point, your stats()
has already removed all time information, so it's no longer possible to draw a timechart.
Do you actually want a time chart, that means the values for one or multiple series over a certain time frame? If yes, what time frame would that be?