Hello everyone
I'm trying to get a list of ip addresses from an internet page and put them after that into a lookup table. My issius is that I can't use mvexpand to put every ip addresses into a single row...
here my search:
| curl method=get uri=https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt
| fields curl_message
| rex field=curl_message mode=sed "s/.*#//g"
| rex field=curl_message mode=sed "s/DstIP//g"
| rex field=curl_message mode=sed "s/^\s+//g"
and as results I will get a big block of data in one single row. How can I split these in multiple rows?
Thank you all for the support.
| mvexpand curl_message
| stats count by curl_message