map search question

[ITSplunk117]

I'm using a modified search from splunksearches.com to get the events from the past two days and returning the difference.  For all of the indexes and sourcetypes, if it exists, in the testlookup. 

 While it works the index and sourcetype does not line up with the results.  Mapping I found handles this SPL a little different than a normal search, location of the stats command had to be moved to return the same results.  
My question is there a way to modify the SPL so the index/sourcetype lines up with the results?  I'm pretty sure I'll eventually get it but already spent enough time on this.  
thanks

testlookup: has the columns index and sourcetype  

| inputlookup testlookup
|eval index1=index
|eval sourcetype1=if (isnull(sourcetype),"","sourcetype="+sourcetype)
|appendpipe
[|map search="search index=$index1$ earliest=-48h latest=-24h | bin _time span=1d | eval window=\"Yesterday\"| stats count by _time window  | append [|search index=$index1$ earliest=-24h | eval window=\"Today\"| bin _time span=1d | stats count by _time window  | eval _time=(_time-(60*60*24))] | timechart span=1d sum(count) by window|eval difference = abs(Yesterday - Today)"]| table index1 sourcetype1 Yesterday Today difference

index1	sourcetype1	yesterday	today	difference
test1	st_test1
		10	20	10

[ITWhisperer · Accepted solution]

map can be slow and limited - try something like this

[| inputlookup testlookup
| table index sourcetype] earliest=-2d@d latest=@d
| eval day=if(_time < relative_time(now(), "-1d@d"), "Yesterday", "Today")
| stats count by day index sourcetype
| eval {day}=count
| stats values(Today) as Today values(Yesterday) as Yesterday by index sourcetype
| fillnull value=0 Yesterday Today
| eval difference=abs(Yesterday - Today)

[ITSplunk117]

Thank you this should work quite well for my needs.