If the device removed from network then how i will get to know in splunk ??

[raja8220]

If the device removed from network or decommissioned then how i will get to know in splunk ??

[ashutoshab]

You can get this done using 'tstats' command. You may run this search Every Hour, Every Day depending upon your requirement.
The below query is for any host that has not sent data for over an hour, you can change the value of 'diff>=3600' to suit your need and run a scheduled search. The 'tstats' command actually does require very less time to complete, it is blazing fast so no need to worry about performance impact.

|tstats latest(_time) as lat_time by host | eval NOW=now() | eval diff=NOW-lat_time | where diff>=3600 | table host

[richgalloway]

You will need a list of expected devices in a lookup file. Compare that file's contents to the current list of devices reporting to Splunk to find those that are missing.

[raja8220]

How to do that I have file called sw.csv it contain the field host which contain all the IP address ??

[richgalloway]

This answer is old, but still works. https://answers.splunk.com/answers/337999/how-to-find-missing-hosts-andor-deployment-clients.html