topic Re: Correlating events from 2 different indexers when there is no common field in Splunk ITSI

Correlating events from 2 different indexers when there is no common field

vijaya5 — Sun, 07 Jun 2020 00:21:43 GMT

Hi,

I have 2 different indexers snmptrapd and servicenow.

Where snmptrap will have NNMI related events for storage devices, such as when any storage device is down/not functional

and servicenow indexer will have incident related events from CMDB data.

So i need to get events with storage device down along with respective Incident data.

Is there any possibility to correlate these 2 indexers, so that i can get required

harishalipaka — Tue, 14 Apr 2020 10:15:55 GMT

@vijaya5

Can you provide sample data ?

kamlesh_vaghela — Tue, 14 Apr 2020 12:18:32 GMT

with expected results 🙂

richgalloway — Tue, 14 Apr 2020 12:42:22 GMT

I believe "indexers" is mis-used here and should be "indexes".