Splunk Search

How to convert column multivalue field to a single row



I need to get the list of indexes with the roles on them.
I use the following search:

| rest /services/authorization/roles splunk_server="local"
| table title, srchIndexesAllowed

The result is displayed in the following format:
     index1   role1
     index2   role1

How do I display it in the following form:
     index1 role1 role2
     index2  role1 role3 

Thank you!


Labels (1)
Tags (1)
0 Karma


It is not clear whether you expect the roles to be in separate fields or a single (string) field

| mvcombine role | nomv role
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...