Splunk Search

Search String for network Devices

syed_star357
New Member

Hi,

We have around 200 Network devices and want to know, we are getting logs from all the network devices, which we have added into splunk.
Please guide me, what is the search string to get the result from number network devices we are getting logs.

Regards,
Syed
+971522874593

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming you've a lookup table created with all the Network device names, say network_devices.csv, and the name of the field contains network device id is device_id and is available in both lookup and your data, then something like this can give you devices for which you didn't receive data

| inputlookup network_devices.csv | eval count=0 | append [search index=yourindex sourcetype=yoursourcetype | stats count by device_id] | stats max(count) as count by device_id | where count=0

View solution in original post

0 Karma

jmallorquin
Builder

I will assuming that every device is define in the host field :

|metadata type=hosts index=xxxxxx

Hope i help you

0 Karma

somesoni2
Revered Legend

Assuming you've a lookup table created with all the Network device names, say network_devices.csv, and the name of the field contains network device id is device_id and is available in both lookup and your data, then something like this can give you devices for which you didn't receive data

| inputlookup network_devices.csv | eval count=0 | append [search index=yourindex sourcetype=yoursourcetype | stats count by device_id] | stats max(count) as count by device_id | where count=0
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...