Is this what you ar looking for ?
| inputlookup itsi_entities append=true
| rename services._key as service_key
| rename title as entity
| fields entity, service_key
| where isnotnull(service_key)
| mvexpand service_key
| inputlookup service_kpi_lookup append=true
| eval key=coalesce(service_key,_key)
| stats values(entity) as entity, values(title) as service by key
| mvexpand entity
| fields entity service
| sort 0 entity
... View more
