Splunk Search

Search String for network Devices

syed_star357
New Member

Hi,

We have around 200 Network devices and want to know, we are getting logs from all the network devices, which we have added into splunk.
Please guide me, what is the search string to get the result from number network devices we are getting logs.

Regards,
Syed
+971522874593

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming you've a lookup table created with all the Network device names, say network_devices.csv, and the name of the field contains network device id is device_id and is available in both lookup and your data, then something like this can give you devices for which you didn't receive data

| inputlookup network_devices.csv | eval count=0 | append [search index=yourindex sourcetype=yoursourcetype | stats count by device_id] | stats max(count) as count by device_id | where count=0

View solution in original post

0 Karma

jmallorquin
Builder

I will assuming that every device is define in the host field :

|metadata type=hosts index=xxxxxx

Hope i help you

0 Karma

somesoni2
Revered Legend

Assuming you've a lookup table created with all the Network device names, say network_devices.csv, and the name of the field contains network device id is device_id and is available in both lookup and your data, then something like this can give you devices for which you didn't receive data

| inputlookup network_devices.csv | eval count=0 | append [search index=yourindex sourcetype=yoursourcetype | stats count by device_id] | stats max(count) as count by device_id | where count=0
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...