I am not sure why you want to use a macro. It would help if we had more context.
However, if I were going to run a search that needed to determine which events had IPs that matched a list of subnets, I would use a lookup.
I would create a file
subnet.csv that contained
ip,subnetName 10.0.0.0/8,internal group 1 172.16.0.0/12,internal group 2 192.168.0.0/16,internal group 3
etc., and upload it to splunk as a lookup table.
[yoursourcetypehere] LOOKUP-lsubnet = subnet_lookup ip OUTPUT subnetName
[subnet_lookup] filename = subnet.csv match_type = CIDR min_matches = 1 max_matches = 1 default_match = unmatched
Then you could use this search to identify events from one of the subnets:
yoursearchhere | where subnetName != "unmatched"
Or this might be interesting
yoursearchhere | stats count by subnetName
Here is the Splunk Lookups Tutorial, if you need more info. One of the nice things about this solution is that you can edit and reload the csv file with new subnets as needed, and all of the searches that use the lookup will automatically use the latest list.
When you are logged into Splunk, go to the app and then to Manager > Lookups
Under Actions for Lookup table files, click Add New.
This will upload the file to
$SPLUNK_HOME/etc/apps/appname/lookups or you can move the file there directly via the OS.