Without knowing the exact searches you are running, it will be difficult to provide the complete answer. However, we can suggest the method to form the search. In theory, you would just group the chart/graph by the type of packet. If you have a field that identifies the traffic, then you would just chart "by field_name". For example, if I had a field that defines my protocol, and I had a sourcetype of syslog, I would do something like:
index=network_stuff sourcetype=syslog | timechart count by protocol
This assumes that I have extracted a field in these events that identifies the correct protocol (as TCP or UDP). You could also create an eventtype that identifies each type of event, then chart "by eventtype".
======UPDATE=======
If the events look something like this:
9/21/10 08:57:00 Host="x.x.x.x" Built outbound TCP connection for outside
9/21/10 08:57:00 Host="x.x.x.x" Built outbound UDP connection for outside
Where the TCP and UDP define the traffic type, the suggested way to leverage your data is to extract a field called protocol. You can use the interactive field extractor, or use a regex with the rex command as follows:
rex "outbound (?<protocol>.*[^ ]) connection"
In total, your search would look like:
index=network_stuff sourcetype=syslog | rex "outbound (?<protocol>.*[^ ]) connection" | timechart count by protocol
... View more
