Hello, I have logs containing two fields "account" and "shard". 
By doing "| table account shard"
I created a table of two cols 
and since the table can have repeating values like:
account                  shard
100                           21
100                           21
100                           8
101                           10
I did "| stats dc(shard) by account", which gives me:
account                 shard
100                          2
101                          1
I have two such tables(before and after) of "account" vs "dc(shard)" and I want to compare them(get the diff in distinct no of shards for each account before and after), but struggling to do this. 
Please guide me to get the result. 
[I can explain anything thats unclear]
Combine your searches and evaluate another field (period) with the appropriate value ("before" or "after"), then use the additional field in the stats command
| stats dc(shard) by account period