How about this
sourcetype=Proxy
[ | search sourcetype=DHCP ((dhcp_mac=”00:8C:AB:22:0B:BF”) OR (dhcp_mac=”48:7D:50:25:7A:69”) OR (dhcp_mac=”54:62:87:91:6A:BB”) OR (dhcp_mac=”54:22:33:51:87:A7”) OR (dhcp_mac=”54:62:69:DB:6A:BB”))
| streamstats window=2 first(dhcp_ip) as px_src_ip first(_time) as latest by dhcp_mac user
| where px_src_ip!=dhcp_ip
| rename _time AS earliest
| fields px_src_ip, earliest, latest
| format "(" "(" " " ")" "OR" ")"]
| table _time, px_src_ip, px_url, px_category
... View more