Hello,
I have logs where there are multiple values for two fields. This data looks like this example below for each event.
dest
user
builtinadmin
computer1
user1 user2
true
false
It comes from this raw data:
<computer N=computer1 D=corp OS=Windows DC=false>
<users>
<user N='user1" builtinadmin="false" />
<user N="user2" builtinadmin="true" />
</users>
</computer>
Is there a way to show the data like this instead where each user correctly correlates to the builinadmin value?
dest
user
builtinadmin
computer1
user1
true
computer1
user2
false
... View more