data extraction

[Siddharthnegi]

hello  I am getting a field port in event .
ports="['22', '68', '6556']"
how can i display them in separate rows.

[kiran_panchavat]

@Siddharthnegi You can use the mvexpand command in Splunk to separate the port numbers into individual rows. 

kiran_panchavat_1-1725633937731.png

If the above solution works, an upvote is appreciated !!

[ITWhisperer]

| rex field=ports max_match=0 "(?<port>\d+)"
| mvexpand port