What is the best way to search, sort and group data of multiple wired and wireless networks by IP?

[stubinski]

Hi, I want to create a report that will graph the traffic from wireless networks and wired networks so that I can see which networks have the most usage. The graph will have two fields - wireless and wired. There are multiple subnets for each network type. There are fewer wireless networks than wired so searching for wireless networks and making everything else "other" is ok.

I've looked at eval, case, if, where, and lookups but I am unsure of the best way to search, sort, and group the data. Any help would be very much appreciated.

Sample data:

Wireless networks - 10.1.1.0 /24, 10.10.10.0/24, 10.20.20.0/24
Wired networks - 10.2.2.0/24, 10.100.100.0/24, 10.200.200.0/24

[somesoni2 · Accepted solution]

You can try something like this

your base search | eval type=if(cidrmatch("10.1.1.0 /24",yourIPfield) OR cidrmatch("10.10.10.0/24",yourIPfield) OR ..other values....,"Wireless","Wired" | stats count by type

[stubinski]

Thanks! This worked!