https://community.splunk.com/t5/Knowledge-Management/cross-field/m-p/393076#M6132 <P>I have a single field that contains SRC address<BR /> several destination and service lines<BR /> I'd like to make crosses.<BR /> and produce a table that contains <BR /> theSRC address to each destination and service</P> <P>SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 80 action: accept<BR /> 3.3.3.3 22<BR /> 4.4.4.4 23</P> <P>i would like a table like this<BR /> SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 80 action: accept<BR /> SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 22 action: accept<BR /> SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 23 action: accept<BR /> SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 80 action: accept<BR /> SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 22 action: accept<BR /> SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 23 action: accept<BR /> SRC: 1.1.1.1 DEST: 4.4.4.4 SRVC: 80 action: accept<BR /> SRC: 1.1.1.1 DEST: 4.4.4.4 SRVC: 22 action: accept<BR /> SRC: 1.1.1.1 DEST:4.4.4.4 SRVC: 23 action: accept</P> Tue, 28 May 2019 15:25:07 GMT rahmane51 2019-05-28T15:25:07Z https://community.splunk.com/t5/Knowledge-Management/cross-field/m-p/393076#M6132 <P>I have a single field that contains SRC address<BR /> several destination and service lines<BR /> I'd like to make crosses.<BR /> and produce a table that contains <BR /> theSRC address to each destination and service</P> <P>SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 80 action: accept<BR /> 3.3.3.3 22<BR /> 4.4.4.4 23</P> <P>i would like a table like this<BR /> SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 80 action: accept<BR /> SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 22 action: accept<BR /> SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 23 action: accept<BR /> SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 80 action: accept<BR /> SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 22 action: accept<BR /> SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 23 action: accept<BR /> SRC: 1.1.1.1 DEST: 4.4.4.4 SRVC: 80 action: accept<BR /> SRC: 1.1.1.1 DEST: 4.4.4.4 SRVC: 22 action: accept<BR /> SRC: 1.1.1.1 DEST:4.4.4.4 SRVC: 23 action: accept</P> Tue, 28 May 2019 15:25:07 GMT https://community.splunk.com/t5/Knowledge-Management/cross-field/m-p/393076#M6132 rahmane51 2019-05-28T15:25:07Z https://community.splunk.com/t5/Knowledge-Management/cross-field/m-p/393077#M6133 <P>Finaly i found solution with mvexpand<BR /> thank you</P> Wed, 29 May 2019 08:29:07 GMT https://community.splunk.com/t5/Knowledge-Management/cross-field/m-p/393077#M6133 rahmane51 2019-05-29T08:29:07Z