You can do something like this:
index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo"
| rename COMMENT AS "We are assuming that the 'src_ip' has the source IP address value and that 'MyCompany.com' is your domain."
| lookup dnslookup clientip AS src_ip OUTPUT clienthost
| eval internal = if(match(clienthost, "(?i)*.MyCompany.com$") OR match(src_ip, "(192\.168\.)\d{1,3}\.\d{1,3}|(10\.)\d{1,3}\.\d{1,3}\.\d{1,3}|(172\.1[6-9]\.)\d{1,3}\.\d{1,3}|(172\.2[0-9]\.)\d{1,3}\.\d{1,3}|(172\.3[0-1]\.)\d{1,3}\.\d{1,3}"), 1, 0)
| where internal == "1"
| stats count dc(dest) BY src_ip
| where count >= YourThresholdNumberHere
... View more