If two IPs are used by one user within 10 minutes, but not the 10 minutes being evaluated, then above search would not return results. Example: if first IP is used at 12:05 and second IP is used at 12:12 while the the first 10 minute span evaluated is 12:00-12:10 and the second span evaluated 12:10-12:20.
In this case, we can eliminate artificial boundaries by searching larger periods of time with stats:
user=* src_ip=* | stats dc(src_ip) as dc_src_ip values(src_ip) as src_ip by user | where dc_src_ip > 1
If we wish to represent this graphically with an area or line chart we could use a search like this:
src_ip=* user=*| streamstats dc(src_ip) as dc_src_ip by user | where dc_src_ip > 1 | timechart span=10m dc(src_ip) as dc_src_ip by user
How would I add time to this query so that each IP a user had would be associated with a specific time period? We have an issue with users on wireless who constantly are changing IPs and I'd like to see at what time they had a specific IP.