https://community.splunk.com/t5/Splunk-Search/map-command-with-functions/m-p/572279#M199455 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240106">@maramel</a>&nbsp;</P><P>Since map uses quotation marks, you must use \ for all special characters within you search.</P><P><SPAN>| map search=" | search index=my_other_index&nbsp; earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), \"true\", \"false\") | table id2 searchip matches cidr_block"</SPAN></P> Mon, 25 Oct 2021 14:05:32 GMT IZ88 2021-10-25T14:05:32Z https://community.splunk.com/t5/Splunk-Search/map-command-with-functions/m-p/572275#M199454 <P>I'm trying to use the map command and it seems to fail when I try using some functions within the subsearch (specifically: cidrmatch()).&nbsp;</P><P>&nbsp;</P><P>This search returns a correctly-populated table of all the fields except for the "matches" field which is just empty&nbsp;<BR /><BR /><BR />index=my_index earliest=-5m<BR />| table _time src_ip<BR />| map search=" | search index=my_other_index&nbsp; earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), "true", "false") | table id2 searchip matches cidr_block"<BR /><BR /><BR />Note: my goal is to join two searches but not based on a common field, based on cidrmatching ips from one search to the cidrblocks in the other. I don't want to use lookup tables as I want both to be dynamic.&nbsp;</P> Mon, 25 Oct 2021 13:54:10 GMT https://community.splunk.com/t5/Splunk-Search/map-command-with-functions/m-p/572275#M199454 maramel 2021-10-25T13:54:10Z https://community.splunk.com/t5/Splunk-Search/map-command-with-functions/m-p/572279#M199455 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/240106">@maramel</a>&nbsp;</P><P>Since map uses quotation marks, you must use \ for all special characters within you search.</P><P><SPAN>| map search=" | search index=my_other_index&nbsp; earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), \"true\", \"false\") | table id2 searchip matches cidr_block"</SPAN></P> Mon, 25 Oct 2021 14:05:32 GMT https://community.splunk.com/t5/Splunk-Search/map-command-with-functions/m-p/572279#M199455 IZ88 2021-10-25T14:05:32Z