FAQ: How do I omit RFC-1918 addresses from my search results?

Note

โŒ› Article is more than two years old.

You can use the cidr() function to omit internal IP addresses according to RFC1918 when focusing on remote IP addresses: 

#event_simpleName=UserLogon 
| !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/32", "169.254.0.0/16", "0.0.0.0/32"])