common among all users

[mcbradford]

I have been asked to identify a list of all websites that a group of users has visited, but the spin on it is that each user must have visited the same website.

For example; user a, b, and c visits google.com, but user d does not, then google would not be in the results. If user a, b, c and d visits abc.com, then abc would be in the results.

[somesoni2 · Accepted solution]

Try this.

Assuming you have search which returns list of USER and WEBSITE used by user.

your base search returning USER and WEBSITE | table USER, WEBSITE | eventstats dc(USER) as TotalUsers | stats count by WEBSITE, TotalUsers | where count=TotalUsers

[mcbradford]

Worked perfect - thanks