Splunk ITSI

Correlating events from 2 different indexers when there is no common field

vijaya5
Engager

Hi,

I have 2 different indexers snmptrapd and servicenow.

Where snmptrap will have NNMI related events for storage devices, such as when any storage device is down/not functional

and servicenow indexer will have incident related events from CMDB data.

So i need to get events with storage device down along with respective Incident data.

Is there any possibility to correlate these 2 indexers, so that i can get required

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I believe "indexers" is mis-used here and should be "indexes".

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishalipaka
Motivator

@vijaya5

Can you provide sample data ?

Thanks
Harish
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

with expected results 🙂

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...