topic data extraction in Splunk Search

data extraction

Siddharthnegi — Mon, 02 Sep 2024 05:10:45 GMT

hello I am getting a field port in event .
ports="['22', '68', '6556']"
how can i display them in separate rows.

ITWhisperer — Mon, 02 Sep 2024 07:05:19 GMT

| rex field=ports max_match=0 "(?<port>\d+)" | mvexpand port

kiran_panchavat — Fri, 06 Sep 2024 14:46:05 GMT

@Siddharthnegi You can use the mvexpand command in Splunk to separate the port numbers into individual rows.

If the above solution works, an upvote is appreciated !!