You could actually do this with just the eval command using the cidrmatch function. (docs)
Here is the example from the docs:
This example uses cidrmatch to set a field, isLocal, to "local" if the field ip matches the subnet, or "not local" if it does not:
... | eval isLocal=if(cidrmatch("123.132.32.0/25",ip), "local", "not local")
This example uses cidrmatch as a filter:
... | where cidrmatch("123.132.32.0/25", ip)
In your case however, you are probably going to want to use the case function rather than the if function.
... | eval group = case(cidrmatch("10.3.227.0/24", ip), "callcntr", cidrmatch("10.3.217.64/cidr_range", ip), "SD" ...
... View more