I would use the cidrmatch function, assuming an index of "proxy" and an IP address field of "ip_address":
index=proxy | eval isRange1=if(cidrmatch("x.x.x.x/a",ip_address),"true","false") eval isRange2=if(cidrmatch("x1.x2.x3.x4/b",ip_address),"true","false") | search (isRange1=true OR isRange2=true)
Where "a" and "b" and the appropriate CIDR masks (use a network calculator to generate them accurately) to limit your IP ranges, like so:
index=proxy | eval isRange1=if(cidrmatch("192.168.1.0/24",ip_address),"true","false") eval isRange2=if(cidrmatch("172.16.0.0/16",ip_address),"true","false") | search (isRange1=true OR isRange2=true)
... View more