@teewenjie22 Try this. Update search as per your requirement. YOUR_SEARCH
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value Sample: | makeresults
| eval _raw="time Server col1 col2 col3
8am SerA 1 2 3
9pm SerA 5 6 7"
| multikv forceheader=1
| table time Server col1 col2 col3
| eval F="",V=""
| foreach col* [| eval F=if(F="","<<FIELD>>",F."|"."<<FIELD>>"), V=if(V="",'<<FIELD>>',V."|".'<<FIELD>>')]
| eval F=split(F,"|"),V=split(V,"|")
| eval t=mvzip(F,V) | fields - F V col*
| mvexpand t
| eval Category=Server."_".mvindex(split(t,","),0), value=mvindex(split(t,","),1) |fields time Category value Thanks KV ▄︻̷̿┻̿═━一 If this reply helps you, an upvote would be appreciated.
... View more
