How to perform Lookup Using Event Field that is a List?

[rrossetti]

I have an event field that is a list of  "permissions" , and I want to perform a lookup for each permission in the list. 

E.g.

Events

name	permissions
app1	send_message
app2	read_user, send_message, write_test

Lookup Table:

permission	risk
send_message	medium
read_user	low
write_test	high

Desired Results

app	permission	risk
app1	send_message	medium
app2	read_user	low
app2	send_message	medium
app2	write_test	high

I want to split the permissions field for each app, and then use the lookup separately so that each row corresponds to an app and one of its permissions. The length of the permissions field is variable. 
I am not sure what is the most efficient way to achieve this. 

[woodcock]

|makeresults | eval _raw="
name domain
app1 google.com
app2 microsoft.com, ibm.com, apple.com"
| multikv forceheader=1
| makemv tokenizer="([^,\s]+)" domain
| mvexpand domain
| rename COMMENT AS "You may not need the above line"
| lookup dnslookup clienthost AS domain

[PickleRick · Accepted solution]

1. Use split() function to split your string "list" into multivalued field

2. Use mvexpand to expand multivalued field into separate rows

3. Do your lookup