https://community.splunk.com/t5/Splunk-Search/compound-query/m-p/21612#M177362 <P>You could approach like this:</P> <PRE><CODE>your search | stats dc(clientip) as dc by serverip | where dc = 3 </CODE></PRE> <P>That counts the unique IPs per server - those rows that have a "3" will have been visited by all three clients.</P> Thu, 01 Aug 2013 11:05:35 GMT martin_mueller 2013-08-01T11:05:35Z https://community.splunk.com/t5/Splunk-Search/compound-query/m-p/21611#M177361 <P>Not sure this is really a "compound query" question, but not sure how else to describe it.</P> <P>I'm searching proxy logs and am interested in finding the "server_ip" (remote web servers) that 3 client_ips (internal users browsing the internet) all have visited.</P> <P>So if... <BR /> client_ip 1 visited server_ip 1 and server_ip X and <BR /> client_ip 2 visited server_ip 2 and server_ip X, and <BR /> client_ip 3 visited server_ip 3 and server_ip X, <BR /> I would like a query to reveal that all 3 client_ips visited server_ip x</P> Mon, 28 Sep 2020 14:29:07 GMT https://community.splunk.com/t5/Splunk-Search/compound-query/m-p/21611#M177361 mikefoti 2020-09-28T14:29:07Z https://community.splunk.com/t5/Splunk-Search/compound-query/m-p/21612#M177362 <P>You could approach like this:</P> <PRE><CODE>your search | stats dc(clientip) as dc by serverip | where dc = 3 </CODE></PRE> <P>That counts the unique IPs per server - those rows that have a "3" will have been visited by all three clients.</P> Thu, 01 Aug 2013 11:05:35 GMT https://community.splunk.com/t5/Splunk-Search/compound-query/m-p/21612#M177362 martin_mueller 2013-08-01T11:05:35Z