How to identify user that connects to more than 1 box?

[SecDesh]

Search Query:
index=winevent source="WinEventLog:Security" EventCode="4624
| stats count by user Source_Network_Address

Output utilizing Sankey visualization:

                            User A                                                                                      10.20.30.40
Target                                          Count                                    Source                                               Count
- 10.20.30.40                                   26                                    User A                                                       26
                                                                                                        User B                                                       30

                            User B                                                                                      10.20.30.50
Target                                          Count                                    Source                                               Count
- 10.20.30.40                                   30                                    User B                                                       10
- 10.20.30.50                                   10

How do I only identify Users that have connected to more than 1 box? I attempted to use the Where function/argument however I may inputting the syntax incorrectly since it provides no results.

[SanjayReddy · Accepted solution]

Hi @SecDesh 

Can you please try this 

UPDATED REPLY

index=winevent source="WinEventLog:Security" EventCode="4624
| stats values(Source_Network_Address)  as SAN by  user 
| eval Total=mvcount(SAN)
| where Total>1

[SecDesh]

The query you provided does work, however it does not work for the Sankey Diagram visualization, much less any other visualization beyond a statistics table since any other doesn't display the IPs, just users and count. I'm assuming because there's now a third/fourth variable. It also doesn't provide the counts for each connection attempt to the IP. However the information is great and I'll see if I can mess around to perfect it. Any other tidbits or help would be greatly appreciated.

Output:

user                                                SAN                                                    Total
User A                                           10.20.30.40                                     2
                                                         10.20.30.50