I had the same issue along with multiple instance{}.id's i needed to break out. Here is what i did to accomplish what i needed, let me know if it works for you.
| dedup name
| spath path=rules{} output=r
| spath path=instances{}
| mvexpand "instances{}.id"
| eval instance_id='instances{}.id'
|mvexpand r
|spath input=r
|eval rule=mvzip('grants{}.cidr_ip','grants{}.group_id')
|eval rule=mvzip(rule, 'grants{}.name')
|eval rule=mvzip(rule, 'grants{}.owner_id')
|mvexpand rule
|makemv rule delim=","
|eval cidr_ip=mvindex(rule,0)
|eval group_id=mvindex(rule,1)
|eval name=mvindex(rule,2)
|eval owner_id=mvindex(rule,3)
| table instance_id from_port cidr_ip group_id name owner_id ip_protocol to_port
... View more