Splunk Search

Split block of data into multiple rows

g_paternicola
Path Finder

Hello everyone

I'm trying to get a list of ip addresses from an internet page and put them after that into a lookup table. My issius is that I can't use mvexpand to put every ip addresses into a single row...

here my search:

| curl method=get uri=https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt
| fields curl_message 
| rex field=curl_message mode=sed "s/.*#//g"
| rex field=curl_message mode=sed "s/DstIP//g"
| rex field=curl_message mode=sed "s/^\s+//g"

and as results I will get a big block of data in one single row. How can I split these in multiple rows?

g_paternicola_0-1644486533083.png

 

Thank you all for the support.

Labels (5)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust
| mvexpand curl_message

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust
| mvexpand curl_message
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by curl_message
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...