topic Checking if device is communication with Splunk given IP or hostname in Security https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522659#M15818 <P>I am very new to Splunk administration. Would anyone help me with a simple search to check if a particular device is reporting to splunk, given it's IP address and/or it's hostname.</P> Fri, 02 Oct 2020 12:12:07 GMT waJesu 2020-10-02T12:12:07Z Checking if device is communication with Splunk given IP or hostname https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522659#M15818 <P>I am very new to Splunk administration. Would anyone help me with a simple search to check if a particular device is reporting to splunk, given it's IP address and/or it's hostname.</P> Fri, 02 Oct 2020 12:12:07 GMT https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522659#M15818 waJesu 2020-10-02T12:12:07Z Re: Checking if device is communication with Splunk given IP or hostname https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522662#M15819 <P>If the device has a Universal Forwarder on it then you can search the internal index for the IP/hostname in question.</P><LI-CODE lang="markup">index=_internal TERM(ip address) index=_internal "host name"</LI-CODE><P>If the device does not have a UF on it then you can search your other indexes for the host.</P><LI-CODE lang="markup">| tstats latest(_time) as time where index=* host="host name"</LI-CODE><P>Use a specific index name in place of * if you know which index has the host's data.</P> Fri, 02 Oct 2020 13:03:22 GMT https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522662#M15819 richgalloway 2020-10-02T13:03:22Z Re: Checking if device is communication with Splunk given IP or hostname https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522673#M15820 <P>Thank you. This was very helpful. Maybe the follow up question would be how to trouble shoot why a device is not communicating.</P> Fri, 02 Oct 2020 14:30:22 GMT https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522673#M15820 waJesu 2020-10-02T14:30:22Z Re: Checking if device is communication with Splunk given IP or hostname https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522674#M15821 <P>Oh I had only tried using host name. The IP one is not returning results.</P> Fri, 02 Oct 2020 14:34:14 GMT https://community.splunk.com/t5/Security/Checking-if-device-is-communication-with-Splunk-given-IP-or/m-p/522674#M15821 waJesu 2020-10-02T14:34:14Z