mv-expand - I cannot make it work!!

CodnChips I tend to use it when trying to get the related alerts from an incident.   If you look at a row in the SecurityIncident table, you will see the AlertIds field is listed like: 

which means it is a JSON array and in this case has 2 entries.   In order to really use this field you would use mv-expand on the column as in 

SecurityIncident
| mv-expand AlertIds

This will create a new row for each entry in the AlertIds column.  All the other columns will be the same but the AlertIds column will only contain a single value per row.  This makes it much easier to perform a join against the SecurityAlert table to get the alert information.