Hi @samp You could use something like this: | makeresults count=6
| streamstats count as n
| eval ip=case(n=1,"100.15.1.10",
n=2,"100.15.99.5",
n=3,"100.36.7.8",
n=4,"100.36.200.1",
n=5,"100.99.1.1",
1=1,"10.0.0.1")
| search [| makeresults
| eval user_input="100.15.*;100.36.*"
| eval ip=split(user_input,";")
| fields ip
| format] This uses a search: [| makeresults
| eval user_input="100.15.*;100.36.*"
| eval ip=split(user_input,";")
| fields ip
| format] To search for the IPs that match the specific pattern/input - You can replace this with a token e.g. $my_ip_list$ etc as required, and you can move it into the initial search command rather than limit later down the search depending on your requirements. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
... View more