the search is:
sourcetype=txt ipAddress="*" | eventstats latest(_time) as latest_time | where _time<relative_time(latest_time,"-7d") | stats range(MachineTotal) as Weekcount by ipAddress | eval Weekcount=round(Weekcount) | join[search] |fieldformat Daycount=round(Weekcount/5) | fields HostName, ipAddress, macAddress, Firmware, Serial, SystemUpTime, Vendor, Model, Contact, Location, Daycount, Weekcount, MachineTotal, PrinterTotal, CopieTotal, FaxTotal
HostName ipAddress macAddress Firmware Serial SystemUpTime Vendor Model Contact Location Daycount Weekcount MachineTotal PrinterTotal CopieTotal FaxTotal
P000824 10.101.225.227 0:26:73:36:2e:db 3.06 V9513401741 4:21:14:26.00 Ricoh Aficio MP C4501 VG-JP Wavre 1719 8594 170858 46986 2
P000729 10.101.31.200 0:26:73:37:ac:f9 1.02 V8013500447 19:2:52:39.00 Ricoh Aficio MP 5001 1164 5820 180623 23430 8653
P000728 10.101.55.200 0:26:73:36:bd:8b 1.02 V8013500398 61:1:49:51.00 Ricoh Aficio MP 5001 427 2137 68921 19927 0
P000730 10.101.55.201 0:26:73:37:ac:fa 1.03 V8013500458 36:0:57:52.00 Ricoh Aficio MP 5001 1503 7515 220973 11099 11344
P000825 10.102.225.227 0:26:73:36:1c:69 3.06 V9513401748 104:22:40:52.00 Ricoh Aficio MP C4501 VG-JP Wavre 2567 12835 214880 58382 2
P310055 10.102.225.249 0:26:73:80:78:21 3.18 W914P104818 60:3:32:36.00 Ricoh Aficio MP 301 163 814 6836 4067 2065
... View more