You could use multivalue fields:
... | stats values(userid) as userids | eval userids=mvjoin(userids,",")
You could use multivalue fields:
... | stats values(userid) as userids | eval userids=mvjoin(userids,",")
I ended up using eventstats rather than stats, thanks Ziegfried!