How do you find details about results using the set command with a diff argument?

[aa274t]

I am using two searches

Search1 search 2
1 1
2 2
3 3
5 4

Using set diff gives me the result. I don't want to use join.

set diff [search index=ABC sourcetype=PQRS| stats count by x_orderno | fields - count]
[search index=DEF sourcetype=WXYZ| stats count by x_orderno | fields - count]

x_orderno
5
4

I want the result as
x_orderno sourcetype
5 PQRS
4 WXYZ

Kindly suggest.

TIA

[woodcock · Accepted solution]

Like this:

| makeresults 
| eval raw="sourcetype=PQRS,x_orderno=1 sourcetype=WXYZ,x_orderno=1 sourcetype=PQRS,x_orderno=2 sourcetype=WXYZ,x_orderno=2 sourcetype=PQRS,x_orderno=3 sourcetype=WXYZ,x_orderno=3 sourcetype=PQRS,x_orderno=5 sourcetype=WXYZ,x_orderno=4" 
| makemv raw 
| mvexpand raw 
| rename raw AS _raw 
| kv

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| stats dc(sourcetype) AS sourcetypeCount values(sourcetype) AS sourcetype BY x_orderno
| where sourcetypeCount==1
| table x_orderno sourcetype

[aa274t]

Awesome. Thanks 🙂

[somesoni2]

Try like this

(index=ABC sourcetype=PQRS) OR (index=DEF sourcetype=WXYZ)
| stats values(sourcetype) as sourcetype by x_orderno
| where mvcount(sourcetype)=1