I have syslog interface events flowing into splunk. Each event is unique with an UP or DOWN within the event data. I'd like to output those results to a table using the DBX addon and build a dashboard only showing interfaces currently in the DOWN state.
Problem is there is no unique key per device.
is it possible to combine 2 fields in the customized_mappings? If the Source_IP+Interface could be combined into a single text field that would work as a unique key. Then the upsert option could be used.
Is this possible? If so how would it be done?
Here are my current customized_mappings
customized_mappings = _time:_time:93,Source_IP:Source_IP:-1,Source_Description:Source_Description:-1,Interface:Interface:Status:Status
you should just be able to use eval
to combine fields. |eval unique_key=Source_IP.Interface