I'm assuming you want a count of accesses by time, grouped by those three categories. Note, this is in pseudosplunk (trademark!).
some search grabbing one event per access to the relevant page | eval traffic_category = "local", "internal", or "external" depending on IP | timechart count by category
You need to provide us with example data from your source.