Splunk Search

How to convert column multivalue field to a single row

mlevsh
Builder

Hi,

I need to get the list of indexes with the roles on them.
I use the following search:

| rest /services/authorization/roles splunk_server="local"
| table title, srchIndexesAllowed

The result is displayed in the following format:
     index1   role1
                      role2
     index2   role1
                      role3

How do I display it in the following form:
     index1 role1 role2
     index2  role1 role3 

Thank you!

 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear whether you expect the roles to be in separate fields or a single (string) field

| mvcombine role | nomv role
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...