Pleas Check Sample Data and Query
JOIN and TRANSACTION both require at least one field to correlate events.
View solution in original post
For calculations, we used the below approach:
sourcetype=source1 | join date,time [search sourcetype=source3] | eval add1 = A +B+ H|join date,time [search sourcetype=source2] | eval add2=C+D |join date,time [search sourcetype=source3] |eval add3 =G+E|eval add4 = F+add3|eval sub = add1 - add4 |eval div = A/sub |eval final-result = div*100
By using “join” function here, we were able to get column names of all three source types and use eval on them. But the join does not consider all the possible combinations.
SHEET contains sample data.