Checking if device is communication with Splunk given IP or hostname

[waJesu]

I am very new to Splunk administration. Would anyone help me with a simple search to check if a particular device is reporting to splunk, given it's IP address and/or it's hostname.

[richgalloway]

If the device has a Universal Forwarder on it then you can search the internal index for the IP/hostname in question.

index=_internal TERM(ip address)

index=_internal "host name"

If the device does not have a UF on it then you can search your other indexes for the host.

| tstats latest(_time) as time where index=* host="host name"

Use a specific index name in place of * if you know which index has the host's data.

[waJesu]

Oh I had only tried using host name. The IP one is not returning results.

[waJesu]

Thank you. This was very helpful. Maybe the follow up question would be how to trouble shoot why a device is not communicating.