Hi @charlesukah22,
you can take logs from two indexes simply using both of them in the main search with OR operator:
index=indexA OR index=indexB
| ...
The problem is how to use these events if it isn't possible to correlate them and what to display.
At least you have to find something common between then and create a correlation using tags and eventtypes:
e.g. if you want the logfail events of two different systems, you could create two eventtypes:
e.g.:
windows_logfail index=wineventlog EventCode=4625
splunk_logfail index=_internal sourcetype=splunkd "login failed"
assign to both of them the same tag (e.g. LOGFAIL) (beware is case sensitive.
then create a search that displays logfails from both the indexes:
tag=LOGFAIL
| rex "user:\s+(?<user>[^ ]+)"
| eval kind=case(index="wineventlog","Windows", index="_internal","Splunk")
| table _time user kind
If you could share more infos I'd be more detailed.
Ciao.
Giuseppe
