Thanks Yuanliu.
I ended up using some of the macro in my search and it works:
| eval service_ids = $fields.ServiceID$
| eval maintenance_object_type = "service", maintenance_object_key = service_ids
| lookup operative_maintenance_log maintenance_object_type, maintenance_object_key OUTPUT _key as maintenance_log_key
| eval in_maintenance = if(IsNull(maintenance_log_key), 0, 1)
| fields - maintenance_object_key, maintenance_object_type, maintenance_log_key
| where IsNull(in_maintenance) OR (in_maintenance != 1)
| fields - in_maintenance
| mvcombine service_ids
| fields - service_ids
I tried a lot of variants for your suggestion to use the macro but didn't find any that worked
... View more