Scenario: I have 10 machines infected with malware. The believed infection source is email, I am attempting to create a search to find if any emails with the same subject line or sender have been sent to all 10 individuals. Basis of search is below, I am just wondering what operator would be used to compare a field to itself and only return the results which are present in the logs of all users . index=email sourcetype=email recipient= user1 OR recipient=user2 OR recipient=user3 AND subject="unknown subject that is the same for all recipients"     ... View more