How does the JOIN or single TRANSACTION work in same log file having multiple source types when we don't have a unique key or referential key?

[Aakanksha]

Pleas Check Sample Data and Query

link text

[yannK · Accepted solution]

JOIN and TRANSACTION both require at least one field to correlate events.

• About the same log file : The JOIN uses a sub search so it could use the same results than the main search.
• is the excel example the actual log file ?

[Aakanksha]

For calculations, we used the below approach:

((A/((SUM(A,B,H)-SUM(D,C,G,E,F)))100))

In Splunk:

sourcetype=source1 | join date,time [search sourcetype=source3] | eval add1 = A +B+ H|join date,time [search sourcetype=source2] | eval add2=C+D |join date,time [search sourcetype=source3] |eval add3 =G+E|eval add4 = F+add3|eval sub = add1 - add4 |eval div = A/sub |eval final-result = div*100

By using “join” function here, we were able to get column names of all three source types and use eval on them. But the join does not consider all the possible combinations.
SHEET contains sample data.