So the source ip field in my results can have multiple results in it. Im trying to figure out how to get each one of those results put into their own cell when exporting to excel. with my current output it puts the source ip's in one cell on the bottom. i would like them to be in their own cells in that same column. Also if there is a way to sort the source ip's as well that would be even more awesome.
... | stats values(src_ip) by dest_port, protocol, dest_ip | sort +dest_port, dest_ip | transpose 1000000
I don't think that will do much for what im trying to achieve. looking over the docs that is used to combine fields that arn't named the same into 1 field. All my fields are correct. I just need to output the source ip's one per cell in the csv that im exporting too.