/command Use command at the base level
[1@172.16.16.1] > {
{… :global mb “1”
{… :global mbc ($mb * 1024 *1024 )
{… :global dstt
{… :global dstta
{… :global dsttp
{… :global dstu
{… :global tcp
{… :global udp
{… :foreach TCP in=[/ip firewall connection find where confirmed srcnat
{[... protocol=tcp tcp-state=established ] do={
{{… :if ([/ip firewall connection get $TCP repl-bytes ] < $mbc ) do={
{{{… :set dstt [/ip firewall connection get $TCP dst-address ];
{{{… :set dstta [:pick $dstt 0 [:find $dstt “:”]];
{{{… :set tcp [/ip firewall connection get $TCP protocol ];
{{{… :put (“$dstta”);
{{{… }}}
216.58.202.3
64.233.190.95
216.58.222.78
172.217.29.78
172.217.29.78
201.34.205.178
172.217.29.110
[1@172.16.16.1] >
My Problem is how to extract the equivalent port number behind the : symbol to set my dsttp var??? 
[:pick $dstt (1 + [:find $dstt ":"])]
Sorry my Friend, doesn’t work, ports have up to 6 numbers
{
:global mb “1”
:global mbc ($mb * 1024 *1024 )
:global dstt
:global dstta
:global dsttp
:global dstu
:global tcp
:global udp
:foreach TCP in=[/ip firewall connection find where confirmed srcnat
protocol=tcp tcp-state=established ] do={
:if ([/ip firewall connection get $TCP repl-bytes ] < $mbc ) do={
:set dstt [/ip firewall connection get $TCP dst-address ];
:set dstta [:pick $dstt 0 [:find $dstt “:”]];
:set dsttp [:pick $dstt (1 + [:find $dstt “:”])]
:set tcp [/ip firewall connection get $TCP protocol ];
:put (“$dstt – $dsttp”);
}}}
Your Option display only the first number
64.233.190.108:993 – 9
216.58.222.142:443 – 4
54.71.121.6:443 – 4
216.58.202.14:443 – 4
216.58.222.35:443 – 4
172.217.28.100:443 – 4
64.233.190.108:993 – 9
52.24.197.120:443 – 4
64.233.190.108:993 – 9
216.58.202.1:443 – 4
Oh, right, sorry. Too much PHP and JavaScript exposure (where omitting the length gets the remainder of the string) had me confused:
[:pick $dstt (1 + [:find $dstt ":"]) [:len $dstt]]
Solved, thank you ! 