Ok, for example with different events
12/7/15 5:30:11.000 PM CEF:0|SI|Audit|1.0|0005|Successful|3|rt=Dec 07 2015 17:30:11 user=JSF eventa=A
12/7/15 5:30:13.000 PM CEF:0|SI|Audit|1.0|0005|Successful|3|rt=Dec 07 2015 17:30:13 user=JSF eventa=B
12/7/15 5:30:16.000 PM CEF:0|SI|Audit|1.0|0005|Successful|3|rt=Dec 07 2015 17:30:16 user=TEST eventa=A
12/7/15 5:30:24.000 PM CEF:0|SI|Audit|1.0|0005|Successful|3|rt=Dec 07 2015 17:30:24 user=JSF eventa=C
12/7/15 5:30:30.000 PM CEF:0|SI|Audit|1.0|0005|Successful|3|rt=Dec 07 2015 17:30:30 user=TEST eventa=C
Here I have to find all users who have eventa=A and eventa=B
Is it possible?
... View more