Hi @maramel Since map uses quotation marks, you must use \ for all special characters within you search. | map search=" | search index=my_other_index earliest=-6h | rename id as id2 | dedup id2 | eval searchip=$src_ip$ | eval matches=if(cidrmatch(cidr_block, searchip), \"true\", \"false\") | table id2 searchip matches cidr_block"
... View more