Hello, I have logs containing two fields "account" and "shard".
By doing "| table account shard"
I created a table of two cols
and since the table can have repeating values like:
account shard
100 21
100 21
100 8
101 10
I did "| stats dc(shard) by account", which gives me:
account shard
100 2
101 1
I have two such tables(before and after) of "account" vs "dc(shard)" and I want to compare them(get the diff in distinct no of shards for each account before and after), but struggling to do this.
Please guide me to get the result.
[I can explain anything thats unclear]
Combine your searches and evaluate another field (period) with the appropriate value ("before" or "after"), then use the additional field in the stats command
| stats dc(shard) by account period