You can see in my Splunk for MikroTik how I do log all DNS request to a tool that can easy analyze all DNS request.
http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-3-3-graphing-everything/121810/1
'Whit drop down list, you can select a singel user and see for a given time all DNS request.
Remember that a visit to just one web site may log 10-20 DNS request to get all advertising, tracker, plugins +++