I have set up my intel download however when i run `http_intel` multiple IOC/values are grouped into a single row.
How do i make it line by line with each unique value?
am i doing it correctly? im still not getting it
It doesn't look like it!
Is domain already a multi-value field?
If not, try
| eval domain=split(domain," ")
| mvexpand domain
thanks! that worked
If it isn't already, then you need to split the field into a multi-value field, then use mvexpand on the multi-value field