How to make a bar graph for two separate search criteria.

[cjpizap]

Hello I would like to make a bar graph that show side by side in one column the results for the total number of clicks blocked based on a certain range of ip addresses and another column that shows the number of clicks blocked not in the specified range of ip addresses. Clicks blocked is a specific value of a field called action. I've tried something like
source = "pp.log" action = "CLKBLK" clickIP ="123.456." or clickIP="789." |stats count as local and this returns the number of clicks blocked but when I try to add in the search for clicks blocked not in those ip ranges I get no results found. Any ideas would be greatly appreciated. I feel like I may just be missing something simple.

[gokadroid]

Please try this query and choose column chart as visualization:

source = "pp.log" action = "CLKBLK" clickIP ="123.456." OR clickIP="789." 
|stats count as local
|eval reportkey="InRange"
| append [search source = "pp.log" action = "CLKBLK" NOT (clickIP ="123.456." OR clickIP="789.")
|stats count as local
|eval reportkey="OutRange"]
| chart max(local) by reportkey

[cjpizap]

This also worked really well so even though I can only accept one answer points for you too. Thanks for the help.

[gokadroid]

@cjpizap - As long as it worked well that's what we answered for. Thanks a lot for up vote !!

[lquinn · Accepted solution]

Assuming you want a count of the clicks blocked, split by whether it is in your IP range or not, try using the case command before your count, like this:

source="pp.log"action="CLKBLK" | eval IPType = case(match(clickIP,"123.456"),"InRange",match(clickIP,"789"),"InRange",match(clickIP,"."), "OutOfRange") | stats count by IPType

[cjpizap]

This worked exactly like I needed thanks.