Here's my solution that I've been piecing together for a while now.  I'm using cidrmatch() to determine internal vs. external, as well as validate IP address format.  I wrap the whole thing in a macro.   Example usage in a query: | eval src_ip_class = `ipClass(src_ip)` Macro Name:  ipClass(1) Macro Arguments:  IP Macro Definition: case( ``` Empty / null ``` isnull($IP$) OR $IP$="", "Empty", ``` Internal IPv4 (RFC1918, CGNAT, loopback, link-local) ``` cidrmatch("10.0.0.0/8", $IP$) OR cidrmatch("172.16.0.0/12", $IP$) OR cidrmatch("192.168.0.0/16",$IP$) OR cidrmatch("100.64.0.0/10", $IP$) ``` CGNAT ``` OR cidrmatch("127.0.0.0/8", $IP$) ``` loopback ``` OR cidrmatch("169.254.0.0/16",$IP$), ``` link-local ``` "Internal IPv4", ``` Internal IPv6 (ULA, link-local, loopback) ``` cidrmatch("fc00::/7", $IP$) ``` Unique local ``` OR cidrmatch("fe80::/10",$IP$) ``` Link-local ``` OR cidrmatch("::1/128",$IP$), ``` Loopback ``` "Internal IPv6", ``` Any remaining valid IPv4 ``` cidrmatch("0.0.0.0/0", $IP$), "External IPv4", ``` Any remaining valid IPv6 ``` cidrmatch("::/0", $IP$), "External IPv6", ``` Everything else ``` 1==1, "Invalid" )   Run Anywhere Example | makeresults count=1 | eval src_ip="10.42.17.8, 172.20.55.13, 192.168.100.77, 100.88.12.200, 127.0.0.1, 169.254.33.10, 8.8.8.8, fd12:3456:789a:1::25, fe80::a4b3:22ff:fe19:7c01, ::1, 2600:1407:5800::5ce, , 999.999.1.2, ham-sandwich, fe80:::1" | eval src_ip = trim(split(src_ip,",")) | mvexpand src_ip ``` ^ Create sample data ^ ``` ```Solution example below``` | eval src_ip_class = `ipClass(src_ip)` | table src_ip src_ip_class | sort 0 src_ip_class ... View more