Splunk Search

How to convert column multivalue field to a single row



I need to get the list of indexes with the roles on them.
I use the following search:

| rest /services/authorization/roles splunk_server="local"
| table title, srchIndexesAllowed

The result is displayed in the following format:
     index1   role1
     index2   role1

How do I display it in the following form:
     index1 role1 role2
     index2  role1 role3 

Thank you!


Labels (1)
Tags (1)
0 Karma


It is not clear whether you expect the roles to be in separate fields or a single (string) field

| mvcombine role | nomv role
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...