Reporting

Group by Multiple - TimeChart Question

richardphung
Communicator

Greetings---

I have Wireless logs that I am attempting to create a Timechart, splitting by Area, and displaying stacked by AccessPoint.

Here is my base search:

 

 

index="wlan" EventType=Authentication
| rex field=AP (?<=AP-)(?<area>.*?)(?=-)
| eval area = upper(area)

 

 


Ideally, I would like to create a Trellis of ...

 

 

| timechart dc(Mac) AS count by AP

 

 

grouped by the field area.

I see loads of examples on answers... this is the closest that I get:
https://community.splunk.com/t5/Splunk-Search/Timechart-count-by-ip-by-fw-name-over-time-with-trelli...

So with this, I get..

 

 

index="wlan" EventType=Authentication
| rex field=AP (?<=AP-)(?<area>.*?)(?=-)
| eval area = upper(area)
| bucket span=30m _time 
| stats dc(Mac) AS count by _time area AP
| eval {AP}=count
| fields - AP count

 

 

Which is VERY close..
My trellis is grouped by area, and it displays my bar chart over time.
However, it 1) does not support stacking, and 2) does not seem to filter the legend... 
in my case, I have around 10 areas and 160 APs., and each chart in the trellis by area displays correctly, but it also displays the all 160 APs in the legend space per chart.

Any help is appreciated.

Labels (1)
Tags (3)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.