All Apps and Add-ons

Lookup table with alerts for new devices plugged into network -- as an app.

New Member

I am trying to develop an app that will continually monitor my network and alert me when a new, never seen before device is plugged in to the LAN.

My thought is to use Splunk Stream and monitor ARP messages coming across the wire. I would then keep a lookup table updated with all the MAC addresses that have been seen so far and alert when I see a new one.

Any thoughts on this approach?
Any major hurdles I may not have thought of?
Any alternative methods that anyone can think of?

0 Karma


Make a kvstore backed lookup. Where the key is the mac address and has a column for lastSeen. Have a search that updates the lookup.

Use the lookup like this

index=myindex sourcetype=myarp data | lookup macTracker macaddress OUTPUTNEW lastSeen isFound | where isnull(isFound) 

That would give you events where the mac has never been seen before.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...