Dashboards & Visualizations

Is it possible to combine 2 fields output those results to a table using the DBX addon and build a dashboard only showing interfaces currently in the DOWN state?

ipops
Path Finder

I have syslog interface events flowing into splunk. Each event is unique with an UP or DOWN within the event data. I'd like to output those results to a table using the DBX addon and build a dashboard only showing interfaces currently in the DOWN state.

Problem is there is no unique key per device.

is it possible to combine 2 fields in the customized_mappings? If the Source_IP+Interface could be combined into a single text field that would work as a unique key. Then the upsert option could be used.

Is this possible? If so how would it be done?

Here are my current customized_mappings

customized_mappings = _time:_time:93,Source_IP:Source_IP:-1,Source_Description:Source_Description:-1,Interface:Interface:Status:Status
0 Karma

cmerriman
Super Champion

you should just be able to use eval to combine fields. |eval unique_key=Source_IP.Interface

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...