I want to be alerted when a new MAC address (device) is connected to a specific vLan. I've started the process by creating a baseline lookup table of attached MAC addresses on the vLan; I did a min(_time) over a 90 day period. Now I want to run a reoccurring search that will look at the MAC addresses within the past 15 minutes and compare those MAC addresses against the lookup table to determine if the MAC Address is new.
I ran this query to obtain the baseline lookup table:
index=cisco-meraki sourcetype="cisco:meraki" src=192.168.12.* | stats min(_time) as first_time by src_mac,device_name | outputlookup mac_tracker.csv
**I ran this query as a suggestion from another community question. The query writes over my 'first_time' field with blank data. I believe the query is supposed to append and new MACs to the existing lookup table. Theoretically, I could then run a query that looks at the 'first_time' field to determine which MAC address has been added most recently.
index=cisco-meraki sourcetype="cisco:meraki" src=192.168.12.* | stats min(_time) as first_time by src_mac,device_name | inputlookup append=true mac_tracker.csv | stats min(_time) as first_time by src_mac,device_name | outputlookup mac_tracker.csv
... View more