How to report for 2 fields?

[weing]

I have a field containing host IP and another field containing subnet IP. I want to report for each host IP, which are the subnet IPs being denied. How do I do this?

4 3/15/11 9:13:34.000 AM Mar 15 09:13:34 10.172.131.51 /opt/qip/usr/bin/dhcpd[6684]: No DHCP lease available to offer from subnet 10.173.130.0. host=10.172.131.51 Options| sourcetype=cisco_syslog Options| source=/opt/syslog-ng/log/dnslog Options| subnet=subnet 10.173.130.0. Options

5 3/15/11 9:13:34.000 AM Mar 15 09:13:34 10.172.131.51 /opt/qip/usr/bin/dhcpd[6684]: No DHCP lease available to offer from subnet 10.173.130.0. host=10.172.131.51 Options| sourcetype=cisco_syslog Options| source=/opt/syslog-ng/log/dnslog Options| subnet=subnet 10.173.130.0. Options

6 3/15/11 9:13:33.000 AM Mar 15 09:13:33 10.172.131.51 /opt/qip/usr/bin/dhcpd[6682]: BOOTP Request failed: No IP available from subnet 10.172.30.0. host=10.172.131.51 Options| sourcetype=cisco_syslog Options| source=/opt/syslog-ng/log/dnslog Options| subnet=subnet 10.172.30.0. Options

[Stephen_Sorkin]

I'd suggest using stats:

... | stats values(subnet) by host

[ftk]

If your fields are already being extracted, you could do one of the following:

your search terms | fields host, subnet

or

your search terms | table host, subnet