Splunk ITSI

Correlating events from 2 different indexers when there is no common field

vijaya5
Engager

Hi,

I have 2 different indexers snmptrapd and servicenow.

Where snmptrap will have NNMI related events for storage devices, such as when any storage device is down/not functional

and servicenow indexer will have incident related events from CMDB data.

So i need to get events with storage device down along with respective Incident data.

Is there any possibility to correlate these 2 indexers, so that i can get required

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I believe "indexers" is mis-used here and should be "indexes".

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishalipaka
Motivator

@vijaya5

Can you provide sample data ?

Thanks
Harish
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

with expected results 🙂

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...