Displaying unique URIs visited per session as columns

[jbrenner]

I have a splunk search that returns two columns, SESSION and URI. How can I show the sequence of URIs visited by each SESSION as columns, with a separate row for each SESSION?

Thanks! 

[ITWhisperer]

What is your search? What results do you get? What would you like them to look like?

[jbrenner]

Exactly what I needed. Thanks!

[jbrenner]

My search returns something like this:

SESSION	URI
b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f	Page1.html
b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f	Page2.html
b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f	Page3.html
42b772ff-b142-471c-a780-080261b084a0	Page2.html
42b772ff-b142-471c-a780-080261b084a0	Page1.html
42b772ff-b142-471c-a780-080261b084a0	Page4.html
42b772ff-b142-471c-a780-080261b084a0	Page5.html
5136941f-a2e7-4c39-83bd-bd5d2709fb18	Page3.html
5136941f-a2e7-4c39-83bd-bd5d2709fb18	Page1.html

And I'd like to transform the results into this (preserving the sort sequence):

SESSION	URI
b4db1013-e31d-4df5-94ed-3b5b2fc0dc1f	Page1.html, Page2.html, Page3.html
42b772ff-b142-471c-a780-080261b084a0	Page2.html, Page1.html, Page4.html, Page5.html
5136941f-a2e7-4c39-83bd-bd5d2709fb18	Page3.html, Page1.html

We can either concatenate the URIs into the same field (as in this example), or we can create a separate column for each URI, whichever is easier.

Thanks!

[ITWhisperer · Accepted solution]

Try something like this

| stats list(URI) as URI by SESSION
| eval URI=mvjoin(URI,",")