Aside from the suggestion that map is generally not a go to solution for most problems, given that all your macro searches are expected to return _time _raw host, could you condense all the macros into a single statement and make the whole thing a subsearch, e.g. [
| inputlookup my_lookup_table
| eval chk_ignore_from=if(Ignore_From!="", strptime(Ignore_From,"%Y/%m/%d %H:%M:%S"), null())
| eval chk_ignore_to =if(Ignore_To!="", strptime(Ignore_To,"%Y/%m/%d %H:%M:%S"), null())
| where isnull(chk_ignore_from) OR isnull(chk_ignore_to)
OR (now() < chk_ignore_from OR now() >= chk_ignore_to)
| where isnotnull(Macro) AND Macro!=""
AND isnotnull(Alert_Mail_Send_To) AND Alert_Mail_Send_To!=""
AND isnotnull(Alert_Mail_Title) AND Alert_Mail_Title!=""
AND isnotnull(Alert_Mail_Body) AND Alert_Mail_Body!=""
| eval Macro=trim(Macro)
| eval Macro=case(match(Macro,"^[\"'].*[\"']$"), substr(Macro,2,len(Macro)-2), true(), Macro)
``` Combine them into multiple OR search conditions ```
| stats values(Macro) as search
| eval search="(".mvjoin(search, ") OR (").")"
]
... That assumes that the macros represent simple search criteria and do not include any kind of pipes or other processing in the search, as they would then not combine to a single set of OR conditions. Then you don't have to use map at all.
... View more
