Application to servers mapping

chained

One possible option is to use Infinity plugin for that:

parse-json
| scope "applications"
| where "name" in ('${Application:text}')
| mv-expand "server"="servers"
| project "server"="server"

1 Like