Here are two solutions I got with Daljeanis and maciep help.
First solution
source="devices:*"
| fields IP_field1, IP_field2, IP_field3 switch_name interface_status
| eval myIPlist = mvdedup(mvappend(IP_field1, IP_field2, IP_field3))
| eval myMAC = mvdedup(mvappend(MAC1, MAC2))
| fields myIPlist switch_name interface_status
| stats values(myMAC) as myMAC, latest(*) as * by myIPlist
| table myIPlist myMAC switch_name interface_status
And here is the second solution
source="devices:*"
| eval myIPlist = coalesce(IP_field1, IP_field2, IP_field3)
| eval myMAC = coalesce(MAC1, MAC2)
| stats values(myMAC) as myMAC, latest(*) as * by myIPlist
| table myIPlist myMAC switch_name interface_status
Chose the one that works best for you
... View more