It can be done without regex.
| makeresults | eval data="['10.1.1.1','10.2.2.2']"
``` Above defines test data. Delete IRL ```
``` Break the IP addresses apart ```
| eval data=split(data,",")
``` Put each IP address in its own event ```
| mvexpand data
``` Trim out excess chars ```
| eval data=trim(trim(data,"[]"), "'")
Here's a run anywhere example that will meet your needs
| makeresults
| eval IPs="['10.1.1.1', '10.2.2.2']"
``` above just creates dummy value ```
| rex field=IPs mode=sed "s/[\[\]']//g" ``` strip unwanted characters to normalise the field ```
| eval IP=split(IPs, ", ") ``` make the field a mutlivalue field ```
| mvexpand IP ``` expand each value to an event ```
Hope this helps
While using your suggestion, the "dummy" data in line two of your suggestion made each event have the same two IPS while the lookup had over 7k. However, I was able to us eth regex and other example of regex to remove the spaces and achieve what I wanted.
| rex field=IP mode=sed "s/[\[\]']//g"
| makemv IP delim=","
| rex field=IP mode=sed "s/(^\s+)|(\s+$)//g"
| mvexpand IP