Splunk Search

How to convert column multivalue field to a single row

mlevsh
Builder

Hi,

I need to get the list of indexes with the roles on them.
I use the following search:

| rest /services/authorization/roles splunk_server="local"
| table title, srchIndexesAllowed

The result is displayed in the following format:
     index1   role1
                      role2
     index2   role1
                      role3

How do I display it in the following form:
     index1 role1 role2
     index2  role1 role3 

Thank you!

 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear whether you expect the roles to be in separate fields or a single (string) field

| mvcombine role | nomv role
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...