New comment on reddit

Now you need a join (most likely – it may be statsable … but my brain isn't gonna do that right now ?)

index=windows dstip=* Account_Name=* [| search index=firewall user=* dstip=* | stats count by dstip | fields dstip ] | stats count by dstip Account_Name | join dstip [| search search index=firewall user=* dstip=* | stats count by user dstip | fields - count ] | stats count by Account_Name user | fields - count