topic Re: How does the JOIN or single TRANSACTION work in same log file having multiple source types when we don't have a unique key or referential key? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-does-the-JOIN-or-single-TRANSACTION-work-in-same-log-file/m-p/59633#M11769 <P>JOIN and TRANSACTION both require at least one field to correlate events.</P> <UL> <LI>About the same log file : The JOIN uses a sub search so it could use the same results than the main search.</LI> <LI>is the excel example the actual log file ?</LI> </UL> Tue, 11 Dec 2012 16:00:16 GMT yannK 2012-12-11T16:00:16Z How does the JOIN or single TRANSACTION work in same log file having multiple source types when we don't have a unique key or referential key? https://community.splunk.com/t5/Getting-Data-In/How-does-the-JOIN-or-single-TRANSACTION-work-in-same-log-file/m-p/59632#M11768 <P>Pleas Check Sample Data and Query</P> <P><A href="http://paste2.org/p/2589888">link text</A></P> Tue, 11 Dec 2012 13:52:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-the-JOIN-or-single-TRANSACTION-work-in-same-log-file/m-p/59632#M11768 Aakanksha 2012-12-11T13:52:42Z Re: How does the JOIN or single TRANSACTION work in same log file having multiple source types when we don't have a unique key or referential key? https://community.splunk.com/t5/Getting-Data-In/How-does-the-JOIN-or-single-TRANSACTION-work-in-same-log-file/m-p/59633#M11769 <P>JOIN and TRANSACTION both require at least one field to correlate events.</P> <UL> <LI>About the same log file : The JOIN uses a sub search so it could use the same results than the main search.</LI> <LI>is the excel example the actual log file ?</LI> </UL> Tue, 11 Dec 2012 16:00:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-the-JOIN-or-single-TRANSACTION-work-in-same-log-file/m-p/59633#M11769 yannK 2012-12-11T16:00:16Z Re: How does the JOIN or single TRANSACTION work in same log file having multiple source types when we don't have a unique key or referential key? https://community.splunk.com/t5/Getting-Data-In/How-does-the-JOIN-or-single-TRANSACTION-work-in-same-log-file/m-p/59634#M11770 <P>For calculations, we used the below approach:</P> <P><STRONG>((A/((SUM(A,B,H)-SUM(D,C,G,E,F)))100))</STRONG></P> <P>In Splunk:</P> <P>sourcetype=source1 | join date,time [search sourcetype=source3] | eval add1 = A +B+ H|join date,time [search sourcetype=source2] | eval add2=C+D |join date,time [search sourcetype=source3] |eval add3 =G+E|eval add4 = F+add3|eval sub = add1 - add4 |eval div = A/sub |eval final-result = div*100</P> <P>By using “join” function here, we were able to get column names of all three source types and use eval on them. But the join does not consider all the possible combinations.<BR /> SHEET contains sample data.</P> Wed, 12 Dec 2012 07:06:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-the-JOIN-or-single-TRANSACTION-work-in-same-log-file/m-p/59634#M11770 Aakanksha 2012-12-12T07:06:34Z