The values and list functions display results in lexicographic order and destroy any potential relationship among the fields. One solution is use mvzip to combine fields, group the results, then unzip the fields. index=okta or index=network
| iplocation (src_ip)
| eval tuple = mvzip(src_ip, mvzip(deviceName, mvzip(City, Country)))
| stats values(tuple) by user, index
| eval fields = split(tuple, ",")
| eval src_ip = mvindex(fields, 0), deviceName=mvindex(fields,1), City=mvindex(fields, 2), Country=mvindex(fields,3) A better approach might be to perform the iplocation command after stats. index=okta or index=network
| stats values(src_ip) as src_ip by user, index
| mvexpand src_ip
| iplocation (src_ip)
... View more
