Splunk Search

Using mvappend within a cidrmatch macro

CarbonCriterium
Path Finder

I already have the following macro  `subnet(3)`  defined as the following:

 

 

| eval subnet = case(cidrmatch("$ip1$/24",src_ip), "$output_name$", cidrmatch("$ip2$",src_ip), "$output_name$")

 

 

 

If I call the macro multiple in the same search the value of the field it creates (also called subnet) will be overwritten by the latest values.   I would like to edit the macro so that calling it multiple times appends a new value to subnet.  How could I use mvappend, or another command, to accomplish this?

Labels (1)
0 Karma
1 Solution

CarbonCriterium
Path Finder

Never mind.  Figuring it out just required taking a step back and reading the docs again.

 

| eval subnet = mvappend(case(cidrmatch("$ip1$/24",src_ip), "$output_name$", cidrmatch("$ip2$",src_ip), "$output_name$"),subnet)

 

 

View solution in original post

0 Karma

CarbonCriterium
Path Finder

Never mind.  Figuring it out just required taking a step back and reading the docs again.

 

| eval subnet = mvappend(case(cidrmatch("$ip1$/24",src_ip), "$output_name$", cidrmatch("$ip2$",src_ip), "$output_name$"),subnet)

 

 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...