Splunk more than one mvcount or if statement in mvcount

[Pmeiring]

Hi Community, 

I'm trying to optimize an existing query to only return values only if a condition is met. 

The existing query:
source="/var/log/wireless.log" AnyConnect OR NetworkDeviceName=fw* "NOTICE Passed-Authentication: Authentication succeeded"
| stats values(Calling_Station_ID) as Public_IP by UserName
| where mvcount(Public_IP) > 1

The output looks something like this: 

Username	Public IP
test6849@domain.com	127.229.3.176 127.89.234.34
Example678	127.122.158.253 127.122.181.170
example5645@domain.com	127.96.171.82 127.13.146.208
Example123	127.114.242.14 127.114.243.135 127.114.252.31
test123@domain.com	127.157.205.179 127.157.211.18
Example586	127.94.41.110 127.114.213.249

What I'm trying to achieve is only to have this return IF the Public IP address subnets differ. 

As an example values I want returned: 

test6849@domain.com

xx.229.3.176 xy.89.234.34

AND not these values - Notice the first 2 subnets are the same (underlined)

Username	Public IP
Example678	xyz.122.158.253 xyz.122.181.170
Example123	127.114.242.14 127.114.243.135 127.114.252.31

I managed to identify the first 2 subnets with regex - but I'm unable to get my query to return values. 

source="/var/log/wireless.log" AnyConnect OR NetworkDeviceName=fw* "NOTICE Passed-Authentication: Authentication succeeded"
| stats values(Calling_Station_ID) as Public_IP by UserName
| stats values(Public_IP_octet) as Subnet_count by UserName
| where (mvcount(Public_IP) > 1 AND mvcount(Subnet_count) < 2)

Any help would be appreciated 

[ITWhisperer · Accepted solution]

source="/var/log/wireless.log" AnyConnect OR NetworkDeviceName=fw* "NOTICE Passed-Authentication: Authentication succeeded"
| rex field=Calling_Station_ID "(?<subnet>\d+\.\d+)"
| stats values(Calling_Station_ID) as Public_IP values(subnet) as Subnets by UserName
| where mvcount(Subnets) > 1

[Pmeiring]

Thanks @ITWhisperer  works perfectly