Your first replace effectively reduces the string to 8 characters and the subsequent replaces are expecting 12 characters so the replaces fail. Also, using map is tricky at the best of times, perhaps...
See more...
Your first replace effectively reduces the string to 8 characters and the subsequent replaces are expecting 12 characters so the replaces fail. Also, using map is tricky at the best of times, perhaps you could try something like this index=main sourcetype=syslog [| makeresults
| eval input_mac="48a4.93b9.xxxx"
| eval mac_clean=lower(replace(input_mac, "[^0-9A-Fa-f]", ""))
| eval mac_colon=replace(mac_clean, "(..)(..)(..)(..)", "\1:\2:\3:\4:")
| eval mac_hyphen=replace(mac_clean, "(..)(..)(..)(..)", "\1-\2-\3-\4-")
| eval mac_dot=replace(mac_clean, "(....)(....)", "\1.\2.")
| eval query=mvappend(mac_colon, mac_hyphen, mac_dot)
| mvexpand query
| table query]
| table _time host _raw"