Using Transactions to identify differences between fields within the transaction

[capilarity]

I have the transaction command running successfully to identify where users log on and log off from our HDI environment using two different log files that end up in the same index, but with different sourcetypes (LogOn or LogOff)
One feature of the HDI is they can move location and take there session with them.
This results in the IP address for the log off being different from the log on IP address.

I'm trying to work out how to identify the user that have moved location during a session

The _raw is the same for both LogOn and LogOff:
Date, time, server, username, IPaddress

The transaction works on the Username and the two different sourcetypes. This works fine and a typical transaction is:

2015/11/03, 23:23:00, ServerA, bobjones, 10.10.10.10
2015/11/03, 20:20:00, ServerA, bobjones, 10.10.10.10

IPAddress=10.10.10.10 | server=ServerA | sourcetype=LogOn sourcetype=LogOff |Username=bobjones

If Bob decides to move location during the day, his transaction look like this:

2015/11/02, 23:23:00, ServerA, bobjones, 10.10.10.20
2015/11/02, 20:20:00, ServerA, bobjones, 10.10.10.10

IPAddress=10.10.10.10 IPAddress=10.10.10.20 | server=ServerA | sourcetype=LogOn sourcetype=LogOff |Username=bobjones

The transaction is correct, but how can I report only on users who have different IP addresses within a transaction so I can post it to a dashboard?
Tried distinct counts to no avail because I need to dc within the transaction, not on the _raw.

Thanks

[DalJeanis]

If you've already rolled it up into a transaction, then IPAddress is a multivalue field for those records.

Just look for the transactions

| where mvcount(IPAddress) > 1