Alternatively, avoid creating that multivalue field in the first place. You said you have some combination of usernames, IPs, and | stats count list() ... so something like this?
base search | stats count list(IP) as IPs by user
Consider using this instead:
base search | stats count by user IP
That'll give you a table like this:
user IP count
a 1.1.1.1 3
a 1.1.1.2 4
b 1.1.1.3 1
Using that, you can now copy over field values to the next row like this:
... | streamstats current=f global=f window=1 last(IP) as last_IP by user
user IP count last_IP
a 1.1.1.1 3
a 1.1.1.2 4 1.1.1.1
b 1.1.1.3 1
Now you can do your comparisons using those two fields. Note only one value is filled due to my small sample size.
...whether that works depends on what you actually want to do. However, in general there's often not a lot of good coming from using list() or values() and then doing more processing on those fields.
... View more
