I tried using below search: 
     index=wineventlog EventCode="4624" | stats values("Security ID") as ids,values("Account Name") as names,values("Account Domain") as domains
   |eval "Security ID1"=mvindex(ids,0),"Security ID2"=mvindex(ids,1)
   |eval "Account Name1"=mvindex(names,0),"Account Name2"=mvindex(names,1)
   |eval "Account Domain1"=mvindex(domains,0),"Account Domain2"=mvindex(domains,1)
   |table "Security ID1","Account Name1","Account Domain1","Security ID2","Account Name2","Account Domain2"
  
 It outputs into as single row table. Its values keep changing in that row instead of writing into the next row when new event found. The time field is empty too. 
 My required output should look like below: 
 _time   Security ID1    Account Name 1  Account Domain1 Security ID2    Account Name 2  Account Domain2  
8.15am  System  DESKTOP-LLHJ389$    Workgroup   Randy Franklin@montereytechgroup.com    rsmith@montereytechgroup.com    New Workgroup  
8.17am  System  SG12345 Workgroup   helen_phua  Helen_phua  newDomain 
						
					
					... View more