How do you get tabular event with field value pair?

[twh1]

I have an event in the below format.

INCIDENT_ID          PROBLEM_KEY                                                 CREATE_TIME                              
-------------------- ----------------------------------------------------------- ---------------------------------------- 
102753               ORA 15064                                                   2018-05-24 15:38:50.242000 -04:00       
107689               ORA 29740                                                   2018-05-24 17:04:00.414000 -04:00       
112801               ORA 32701                                                   2018-05-24 20:59:14.420000 -04:00 

I need this data as INCIDENT_ID field with values (102753, 107689, 112801), and PROBLEM_KEY, CREATE_TIME fields in same way. I used multikv command, but I am not getting the desired result.

base search | multikv fields INCIDENT_ID PROBLEM_KEY CREATE_TIME | table INCIDENT_ID PROBLEM_KEY CREATE_TIME

[twh1 · Accepted solution]

I got the desired output by using below command.

base search | multikv | table INCIDENT_ID PROBLEM_KEY CREATE_TIME

[somesoni2]

What's the current output looks like and what should be the expected output?

[twh1]

@somesoni2 :

I need 3 fileds(INCIDENT_ID, PROBLEM_KEY, CREATE_TIME) should get created at run time. When I use table command to print these fields respective column value should come in that field.

[renjith_nair]

@twh1, if its currently displaying as a single row, then try

your search|eval z=mvzip(mvzip( INCIDENT_ID ,PROBLEM_KEY,"," ),CREATE_TIME,"," )|fields z|mvexpand z|eval s=split(z,",")|eval INCIDENT_ID=mvindex(s,0),PROBLEM_KEY=mvindex(s,1),CREATE_TIME=mvindex(s,2)|fields INCIDENT_ID,PROBLEM_KEY,CREATE_TIME

[twh1]

Hi @renjith.nair
I tried above query but didn't get the desired output.