The likely thing you really want to do here is to leverage the rare detector function to find a country that is rare for a user
rare by source.geo.country_code2.keyword partition=user.name
See a similar example here: Dec 4th, 2018: [EN][ML] Rarity Analysis with Machine Learning
Just want to be cognizant of the cardinality of the user.name field. If it is really high you'll require a lot of memory utilization for the job.
Also, from your screenshot it seems like your data has empty string for some user names. You might want to filter those out in the datafeed query (??)