We are currently getting a log like this from our F5.
xff="184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124"
I'd like to mvexpand it. I assumed I could just |mvexpand xff, but that doesn't not work.
Any idea how I would tackle this?
You have to make it a multivalued field first, like this:
... | makemv delim="," xff | mvexpand xff
... | eval x=split(xff, ",") | mvexpand x