With this search
index=useradmin sourcetype=role_capabilities| eval capabilities=replace(capabilities,"\s",",")| makemv delim="," capabilities| table role capabilities
I expected a result like
role 2 capability1
instead I get
role 1 capabilty1
Probably my expectations of makemv are not correct but I can't find another command to make this work.
The reason I want it in this way is to get layout of the print of the dashboard I use this with properly.
@rrovers try using mvexpand comand on your results set-
View solution in original post
@493669, thanks, that's what I was looking for
@rrovers Please accept it as solution to help future readers as well.