Search String for network Devices

[syed_star357]

Hi,

We have around 200 Network devices and want to know, we are getting logs from all the network devices, which we have added into splunk.
Please guide me, what is the search string to get the result from number network devices we are getting logs.

Regards,
Syed
+971522874593

[jmallorquin]

I will assuming that every device is define in the host field :

|metadata type=hosts index=xxxxxx

Hope i help you

[somesoni2 · Accepted solution]

Assuming you've a lookup table created with all the Network device names, say network_devices.csv, and the name of the field contains network device id is device_id and is available in both lookup and your data, then something like this can give you devices for which you didn't receive data

| inputlookup network_devices.csv | eval count=0 | append [search index=yourindex sourcetype=yoursourcetype | stats count by device_id] | stats max(count) as count by device_id | where count=0