Greetings---
I have Wireless logs that I am attempting to create a Timechart, splitting by Area, and displaying stacked by AccessPoint.
Here is my base search:
index="wlan" EventType=Authentication
| rex field=AP (?<=AP-)(?<area>.*?)(?=-)
| eval area = upper(area)
Ideally, I would like to create a Trellis of ...
| timechart dc(Mac) AS count by AP
grouped by the field area.
I see loads of examples on answers... this is the closest that I get:
https://community.splunk.com/t5/Splunk-Search/Timechart-count-by-ip-by-fw-name-over-time-with-trelli...
So with this, I get..
index="wlan" EventType=Authentication
| rex field=AP (?<=AP-)(?<area>.*?)(?=-)
| eval area = upper(area)
| bucket span=30m _time
| stats dc(Mac) AS count by _time area AP
| eval {AP}=count
| fields - AP count
Which is VERY close..
My trellis is grouped by area, and it displays my bar chart over time.
However, it 1) does not support stacking, and 2) does not seem to filter the legend...
in my case, I have around 10 areas and 160 APs., and each chart in the trellis by area displays correctly, but it also displays the all 160 APs in the legend space per chart.
Any help is appreciated.
