Trying to search web access logs to find instances where a specific IP only called a single URL, and no other URLs. This IP could have made this call more than once, but didn't request any other URLs through that server. Basically looking for a list of IPs that requested the "/test.html" page, and nothing else. This is what I tried so far, but it's just grouping by IP and showing all the URLs. sourcetype=webaccess clientip!="-" | stats count by clientip | stats list(url) as URL, list(count) as Count, sum(count) as CountByIP by clientip | where CountByIP=1 AND URL="/test.html" ... View more