How to get the column result into row wise for multivalue events?

[VsplunkV]

Hi Everyone,

I have multivalues in the events, As per the Screenshot below, How can I get the DiskGB value in row Instead of Column. Expect output show in the Below Screenshot. Can someone please help me with the query.

Thank you in Advance.

[somesoni2 · Accepted solution]

If you search is like this (last command being stats, aggregate function for Memory can be different)

your base search | ... other code...
| stats max(Memory) as Memory values(DiskGB) as DiskGB by Service

Then try like this

your base search | ... other code...
| stats max(Memory) as Memory values(DiskGB) as DiskGB by Service delim="," | nomv DiskGB