Splunk Search

How to convert column multivalue field to a single row



I need to get the list of indexes with the roles on them.
I use the following search:

| rest /services/authorization/roles splunk_server="local"
| table title, srchIndexesAllowed

The result is displayed in the following format:
     index1   role1
     index2   role1

How do I display it in the following form:
     index1 role1 role2
     index2  role1 role3 

Thank you!


Labels (1)
Tags (1)
0 Karma


It is not clear whether you expect the roles to be in separate fields or a single (string) field

| mvcombine role | nomv role
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...