How to make it line by line with each unique value?

[bluewizard]

I have set up my intel download however when i run `http_intel` multiple IOC/values are grouped into a single row. 

How do i make it line by line with each unique value?

[bluewizard]

am i doing it correctly? im still not getting it

[ITWhisperer]

It doesn't look like it!

Is domain already a multi-value field?

If not, try

| eval domain=split(domain," ")
| mvexpand domain

[bluewizard]

thanks! that worked

[ITWhisperer]

If it isn't already, then you need to split the field into a multi-value field, then use mvexpand on the multi-value field