https://community.splunk.com/t5/Splunk-Search/Search-String-for-network-Devices/m-p/266235#M189872 <P>Assuming you've a lookup table created with all the Network device names, say network_devices.csv, and the name of the field contains network device id is device_id and is available in both lookup and your data, then something like this can give you devices for which you didn't receive data</P> <PRE><CODE>| inputlookup network_devices.csv | eval count=0 | append [search index=yourindex sourcetype=yoursourcetype | stats count by device_id] | stats max(count) as count by device_id | where count=0 </CODE></PRE> Tue, 29 Sep 2020 09:14:04 GMT somesoni2 2020-09-29T09:14:04Z https://community.splunk.com/t5/Splunk-Search/Search-String-for-network-Devices/m-p/266234#M189871 <P>Hi,</P> <P>We have around 200 Network devices and want to know, we are getting logs from all the network devices, which we have added into splunk.<BR /> Please guide me, what is the search string to get the result from number network devices we are getting logs.</P> <P>Regards,<BR /> Syed<BR /> +971522874593</P> Thu, 31 Mar 2016 05:47:15 GMT https://community.splunk.com/t5/Splunk-Search/Search-String-for-network-Devices/m-p/266234#M189871 syed_star357 2016-03-31T05:47:15Z https://community.splunk.com/t5/Splunk-Search/Search-String-for-network-Devices/m-p/266235#M189872 <P>Assuming you've a lookup table created with all the Network device names, say network_devices.csv, and the name of the field contains network device id is device_id and is available in both lookup and your data, then something like this can give you devices for which you didn't receive data</P> <PRE><CODE>| inputlookup network_devices.csv | eval count=0 | append [search index=yourindex sourcetype=yoursourcetype | stats count by device_id] | stats max(count) as count by device_id | where count=0 </CODE></PRE> Tue, 29 Sep 2020 09:14:04 GMT https://community.splunk.com/t5/Splunk-Search/Search-String-for-network-Devices/m-p/266235#M189872 somesoni2 2020-09-29T09:14:04Z https://community.splunk.com/t5/Splunk-Search/Search-String-for-network-Devices/m-p/266236#M189873 <P>I will assuming that every device is define in the host field :</P> <PRE><CODE>|metadata type=hosts index=xxxxxx </CODE></PRE> <P>Hope i help you</P> Thu, 31 Mar 2016 14:41:30 GMT https://community.splunk.com/t5/Splunk-Search/Search-String-for-network-Devices/m-p/266236#M189873 jmallorquin 2016-03-31T14:41:30Z