sourcetype="A" OR sourcetype="B"
| eval sourcetypeA=if(sourcetype="A",sourcetype,null)
| eval sourcetypeB=if(sourcetype="B",sourcetype,null)
| stats values(sourcetypeA) as sourcetypeA values(sourcetypeB) as sourcetypeB by login
| where sourcetypeA="A" and isnull(sourcetypeB)
| stats count
... View more