Splunk ITSI

Correlating events from 2 different indexers when there is no common field

vijaya5
Engager

Hi,

I have 2 different indexers snmptrapd and servicenow.

Where snmptrap will have NNMI related events for storage devices, such as when any storage device is down/not functional

and servicenow indexer will have incident related events from CMDB data.

So i need to get events with storage device down along with respective Incident data.

Is there any possibility to correlate these 2 indexers, so that i can get required

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I believe "indexers" is mis-used here and should be "indexes".

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishalipaka
Motivator

@vijaya5

Can you provide sample data ?

Thanks
Harish
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

with expected results 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

  March 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...