Not sure this is really a "compound query" question, but not sure how else to describe it.
I'm searching proxy logs and am interested in finding the "server_ip" (remote web servers) that 3 client_ips (internal users browsing the internet) all have visited.
So if...
client_ip 1 visited server_ip 1 and server_ip X and
client_ip 2 visited server_ip 2 and server_ip X, and
client_ip 3 visited server_ip 3 and server_ip X,
I would like a query to reveal that all 3 client_ips visited server_ip x
You could approach like this:
your search | stats dc(clientip) as dc by serverip | where dc = 3
That counts the unique IPs per server - those rows that have a "3" will have been visited by all three clients.
You could approach like this:
your search | stats dc(clientip) as dc by serverip | where dc = 3
That counts the unique IPs per server - those rows that have a "3" will have been visited by all three clients.