Knowledge Management

cross field

rahmane51
New Member

I have a single field that contains SRC address
several destination and service lines
I'd like to make crosses.
and produce a table that contains
theSRC address to each destination and service

SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 80 action: accept
3.3.3.3 22
4.4.4.4 23

i would like a table like this
SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 80 action: accept
SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 22 action: accept
SRC: 1.1.1.1 DEST: 2.2.2.2 SRVC: 23 action: accept
SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 80 action: accept
SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 22 action: accept
SRC: 1.1.1.1 DEST: 3.3.3.3 SRVC: 23 action: accept
SRC: 1.1.1.1 DEST: 4.4.4.4 SRVC: 80 action: accept
SRC: 1.1.1.1 DEST: 4.4.4.4 SRVC: 22 action: accept
SRC: 1.1.1.1 DEST:4.4.4.4 SRVC: 23 action: accept

Tags (1)
0 Karma

rahmane51
New Member

Finaly i found solution with mvexpand
thank you

0 Karma
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...