updated the search.. it was the eval.. I replaced the "" with null() I had to test it. Now it should work. This what I used to test it now | makeresults
| eval src.ip = "1.1.1.1,1.1.2.2,1.2.3.4"
| makemv src.ip delim=","
| mvexpand src.ip
| rename src.ip AS src_ip
| eval text = if(src_ip="1.1.1.1","mfa","vpn")
| eval user = "user"
| eval mfa = if(text="mfa",src_ip,null())
| eval vpn = if(text="vpn",src_ip,null())
| stats latest(mfa) AS mfa latest(vpn) as vpn by user
| iplocation prefix=mfa_ mfa
| iplocation prefix=vpn_ vpn
... View more