I tried using below search:
index=wineventlog EventCode="4624" | stats values("Security ID") as ids,values("Account Name") as names,values("Account Domain") as domains
|eval "Security ID1"=mvindex(ids,0),"Security ID2"=mvindex(ids,1)
|eval "Account Name1"=mvindex(names,0),"Account Name2"=mvindex(names,1)
|eval "Account Domain1"=mvindex(domains,0),"Account Domain2"=mvindex(domains,1)
|table "Security ID1","Account Name1","Account Domain1","Security ID2","Account Name2","Account Domain2"
It outputs into as single row table. Its values keep changing in that row instead of writing into the next row when new event found. The time field is empty too.
My required output should look like below:
_time Security ID1 Account Name 1 Account Domain1 Security ID2 Account Name 2 Account Domain2
8.15am System DESKTOP-LLHJ389$ Workgroup Randy Franklin@montereytechgroup.com rsmith@montereytechgroup.com New Workgroup
8.17am System SG12345 Workgroup helen_phua Helen_phua newDomain
... View more