Dashboards & Visualizations

Is it possible to combine 2 fields output those results to a table using the DBX addon and build a dashboard only showing interfaces currently in the DOWN state?

ipops
Path Finder

I have syslog interface events flowing into splunk. Each event is unique with an UP or DOWN within the event data. I'd like to output those results to a table using the DBX addon and build a dashboard only showing interfaces currently in the DOWN state.

Problem is there is no unique key per device.

is it possible to combine 2 fields in the customized_mappings? If the Source_IP+Interface could be combined into a single text field that would work as a unique key. Then the upsert option could be used.

Is this possible? If so how would it be done?

Here are my current customized_mappings

customized_mappings = _time:_time:93,Source_IP:Source_IP:-1,Source_Description:Source_Description:-1,Interface:Interface:Status:Status
0 Karma

cmerriman
Super Champion

you should just be able to use eval to combine fields. |eval unique_key=Source_IP.Interface

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...