Compare results from day to day

[girtsgr]

Let's assume I have data structured like this:
|timestamp|user|action|
|2019-09-10 13:40|user1|action1|
|2019-09-10 12:40|user2|action2|
|2019-09-09 12:40|user3|action3|
|2019-09-09 13:40|user1|action1|
|2019-09-09 12:40|user3|action4|
|2019-09-09 11:40|user1|action1|
|2019-09-09 09:40|user2|action2|

Now, I would like to search for events where users have performed the same actions, in this case, I would like to have these events in my search:
|2019-09-10 13:40|user1|action1|
|2019-09-09 13:40|user1|action1|
|2019-09-09 11:40|user1|action1|
|2019-09-10 12:40|user2|action2|
|2019-09-09 09:40|user2|action2|

I tried subsearches and selfjoin, but to no avail. In what direction should I look?

[ChrisCLewis · Accepted solution]

Hopefully this will give you a new direction

|eval unique=user."".action
|stats dc(unique) as filter values(time) as time by user action |where filter>1 |sort user |fields - filter

[girtsgr]

Thank you, this seems promising.