https://community.splunk.com/t5/Splunk-Search/How-can-I-show-a-list-of-devices-that-have-been-offline-for-more/m-p/494504#M194518 <P>This is the <CODE>Sentinel Search</CODE> problem discussed (with solution) here:<BR /> <A href="https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf">https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf</A></P> Wed, 27 Nov 2019 21:33:49 GMT woodcock 2019-11-27T21:33:49Z https://community.splunk.com/t5/Splunk-Search/How-can-I-show-a-list-of-devices-that-have-been-offline-for-more/m-p/494503#M194517 <P>New to Splunk and trying to learn it: sorry for the dumb question.</P> <P>So I am trying to filter out a list of POS devices that have not passed any traffic in the past 7 days so I can build reports for techs to replace.<BR /> <STRONG>index="hgm" AND model="POS" AND ERROR="Failed" AND Client_Sessions =0 | stats dc(MACADDRESS) by IP</STRONG><BR /> I guess I need to get a count of Unique MAC addresses for these devices so I can plot a chart AND make sure that Client_Sessions are 0 during the whole day<BR /> Any Idea how I can get that done?</P> Wed, 27 Nov 2019 20:31:02 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-show-a-list-of-devices-that-have-been-offline-for-more/m-p/494503#M194517 kourbeh 2019-11-27T20:31:02Z https://community.splunk.com/t5/Splunk-Search/How-can-I-show-a-list-of-devices-that-have-been-offline-for-more/m-p/494504#M194518 <P>This is the <CODE>Sentinel Search</CODE> problem discussed (with solution) here:<BR /> <A href="https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf">https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf</A></P> Wed, 27 Nov 2019 21:33:49 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-show-a-list-of-devices-that-have-been-offline-for-more/m-p/494504#M194518 woodcock 2019-11-27T21:33:49Z