Using split in your emulation kind of obscures characteristics of the real data, how real data becomes multivalued, etc. But working from this - please post test code/mock code in text, not screensh...
See more...
Using split in your emulation kind of obscures characteristics of the real data, how real data becomes multivalued, etc. But working from this - please post test code/mock code in text, not screenshot, there is a potential way to leverage sort command that automatically recognizes IPv4 format. | makeresults
| eval ip = split("119.0.6.159,62.0.3.75,63.0.3.84,75.0.3.80,92.0.4.159", ",")
| mvexpand ip
| sort ip
| stats values(ip) as ip list(ip) as sorted_ip This gives you ip sorted_ip 119.0.6.159 62.0.3.75 63.0.3.84 75.0.3.80 92.0.4.159 62.0.3.75 63.0.3.84 75.0.3.80 92.0.4.159 119.0.6.159 mvexpand can be expensive. list can be memory hungry. So, think of data strategy if performance is a concern. Do you have to present results in multivalue format?