compound query

[mikefoti]

Not sure this is really a "compound query" question, but not sure how else to describe it.

I'm searching proxy logs and am interested in finding the "server_ip" (remote web servers) that 3 client_ips (internal users browsing the internet) all have visited.

So if...
client_ip 1 visited server_ip 1 and server_ip X and
client_ip 2 visited server_ip 2 and server_ip X, and
client_ip 3 visited server_ip 3 and server_ip X,
I would like a query to reveal that all 3 client_ips visited server_ip x

[martin_mueller · Accepted solution]

You could approach like this:

your search | stats dc(clientip) as dc by serverip | where dc = 3

That counts the unique IPs per server - those rows that have a "3" will have been visited by all three clients.