I am new to Splunk with questions below. Can anyone can help interpret the following request into a Splunk search statement? Dataset is like below: field_a field_b field_c string_a b1 c1 string_b b1 c2 string_c b1 c3 string_c b2 c3 string_d b2 c4 string_d b1 c5 I am going to create a splunk search like following SQL select* from table where field_a in ("string_a","string_b","string_c") and field_b in ( select field_b from table where field_a in ("stirng_a","string_b","string_c") group by field_b having count(distinct field_a) = 3) The expectation is to return all the rows for a field_b with all where all string_a, string_b, and string_c occurred in field_a, such as: field_a field_b field_c string_a b1 c1 string_b b1 c2 string_c b1 c3 Thank you all in advance. ... View more