How to combine multiple rows in a field to one row in the same field?

[splunkerer]

I have a data set as seen below.

exec                   arguments

/bin/sh

sh -c uname -p ** /dev/null

/sbin/ldconfig

/bin/sh /sbin/ldconfig -p

/bin/uname

uname -m

as seen above sample data, some of the argument fields have 3 lines on them, some of them 2 or 5 etc. all of them are different. 

I would like to get the following result

exec                           arguments
----------------------------------------
/bin/sh                      sh -c uname -p ** /dev/null
/sbin/ldconfig        /bin/sh /sbin/ldconfig -p
/bin/uname             uname -m

How can I get this result?
Thanks,

[ITWhisperer · Accepted solution]

If arguments is a multi-value field, use

| eval arguments=mvjoin(arguments," ")

[splunkerer]

wow, I spent 2 hours to resolve this. you are amazing! Thanks a bunch! 

[yuanliu]

If the data is strictly formatted, you can use rex to simply collapse lines:  

| rex field=arguments mode=sed "s/
/ /g"

 e.g.,

| makeresults 
| eval exec = "/bin/sh", arguments = "sh
-c
uname -p ** /dev/null"
| rex field=arguments mode=sed "s/
/ /g"

gives

_time	arguments	exec
2021-05-20 06:33:07	sh -c uname -p ** /dev/null	/bin/sh

Without  rex, the output is

_time	arguments	exec
2021-05-20 06:42:40	sh -c uname -p ** /dev/null	/bin/sh

[splunkerer]

Thanks for sharing your solution, but this did not work on my end.