--- title: Discover Connected Devices with Splunk description: Discover how Splunk can help businesses keep inventory of all connected devices with our case study. See how to discover connected devices with Splunk. image: https://blog.iptel.com.au/hubfs/How%20Splunk%20Helps%20Businesses%20Discover%20Connected%20Devices/Copy%20of%20Cisco%20AuHow%20Splunk%20Helps%20Businesses%20Discover%20Connected%20Devices%20(Instagram%20Post).gif --- [![IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)](https://blog.iptel.com.au/hs-fs/hubfs/IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png?width=200&height=59&name=IPTellogo-byline-2020-dark-v2-pnd-optimised-500%20(1).png "IPTellogo-byline-2020-dark-v2-pnd-optimised-500 (1)")](https://iptel.com.au) - [Home](https://iptel.com.au/) - [Solutions](https://iptel.com.au/solutions) Technologies - [Cisco Access Manager](https://iptel.com.au/technologies/cisco-access-manager) - [Cisco Catalyst Centre](https://iptel.com.au/technologies/cisco-catalyst-center) - [Cisco Meraki](https://iptel.com.au/technologies/cisco-meraki) - [Cisco SDA Fabric](https://iptel.com.au/technologies/cisco-sda-fabric) - [Cisco Spaces](https://iptel.com.au/technologies/cisco-spaces) - [Everpure Storage](https://iptel.com.au/technologies/everpure-storage) - [Industrial IoT](https://iptel.com.au/technologies/industrial-iot) - [LAN](https://iptel.com.au/technologies/lan) - [Security and Cisco ISE](https://iptel.com.au/technologies/security-and-cisco-ise) - [Thousand Eyes](https://iptel.com.au/technologies/thousandeyes) - [Virtualisation](https://iptel.com.au/technologies/virtualisation) - [Wi-Fi](https://iptel.com.au/services/wi-fi-surveys) Services - [Backup Assure](https://iptel.com.au/services/backup-assure) - [Cisco URWB](https://iptel.com.au/services/cisco-urb) - [Cisco Webex Calling](https://iptel.com.au/services/cisco-webex-calling) - [Eco-Friendly Network Refresh](https://iptel.com.au/services/eco-friendly-network-refresh) - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Splunk](https://iptel.com.au/services/splunk) - [Wi-Fi Assurance Review](https://iptel.com.au/services/wi-fi-assurance-review) - [Wi-Fi Surveys](https://iptel.com.au/services/wi-fi-surveys) - [Industries](https://iptel.com.au/industries) Education and Healthcare - [Education and Campuses](https://iptel.com.au/industries/education) - [Healthcare and Clinical](https://iptel.com.au/industries/healthcare) - [Aged Care](https://iptel.com.au/industries/aged-care) Enterprise - [Enterprise Networks](https://iptel.com.au/industries/enterprise) Industrial - [Mining and Camps](https://iptel.com.au/industries/mines) - [Utilities](https://iptel.com.au/industries/utilities) Retail & Warehousing - [Retail](https://iptel.com.au/industries/retail-and-stores) - [Warehousing](https://iptel.com.au/industries/warehousing) Entertainment - [Stadiums](https://iptel.com.au/industries/stadiums) - [Hospitality](https://iptel.com.au/hospitality-and-hotels) - [MSP](https://iptel.com.au/managed-services) Meraki - [Meraki Access](https://iptel.com.au/managed-services/meraki-access-and-security) - [Meraki Security and SD-WAN](https://iptel.com.au/managed-services/meraki-sd-wan) Cisco - [Cisco Campus Access](https://iptel.com.au/managed-services/cisco-campus-access) - [Cisco SD-WAN](https://iptel.com.au/managed-services/cisco-sd-wan) - [Cisco ISE](https://iptel.com.au/managed-services/cisco-ise) Security and Collaboration - [Security Service Edge](https://iptel.com.au/managed-services/security-service-edge) - [Meeting Rooms](https://iptel.com.au/managed-services/meeting-rooms-as-a-service) Data Centre and More - [AI Infrastructure](https://iptel.com.au/managed-services/ai-infrastructure) - [Non-Cisco Devices](https://iptel.com.au/managed-services/non-cisco-device-management) - [Full Stack Observability](https://iptel.com.au/managed-services/full-stack-observability) - [Equipment](https://iptel.com.au/services/network-equipment-supply) Equipment Supply - [Network Equipment Supply](https://iptel.com.au/services/network-equipment-supply) - [Buy Cisco Equipment](https://iptel.com.au/services/cisco-equipment-supply) - [Buy Meraki Equipment](https://iptel.com.au/services/meraki-equipment-supply) Get Pricing - [Get a Hardware Quote](https://iptel.com.au/services/network-equipment-supply#hardware-quote) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) - [Blog](https://blog.iptel.com.au) - [Resources](https://iptel.com.au/resources) Free Resources - [Top Wi-Fi Secrets](https://iptel.com.au/top-8-wi-fi-secrets) - [Cisco SDA Fabric](https://iptel.com.au/the-cios-guide-to-sda-fabric) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) Assessments - [Cloud AI Assessment](https://score.iptel.com.au/cloud-ai-assessment) - [Collaboration Assessment](https://score.iptel.com.au/collaboration-assessment) - [Network Assessment](https://score.iptel.com.au/network-assessment) - [Security Assessment](https://score.iptel.com.au/security-assessment) - [Splunk Assessment](https://score.iptel.com.au/splunk-assessment) Tools - [Automating Meraki](https://www.automatingmeraki.com) - [MAC Address Converter](https://iptel.com.au/resources/mac-address-converter) - [MSP Assessment Tool](https://score.iptel.com.au/cisco-managed-services) - [Thousand Eyes Option Tool](https://score.iptel.com.au/thousandeyes) - [Wi-Fi AP Estimator](https://iptel.com.au/resources/wifi-access-point-estimator) Demos and Design - [Request a Meraki Demo](https://iptel.com.au/free-meraki-demo) - [FREE Meeting Room Design](https://iptel.com.au/schedule-meeting-room-design-session) - [Catalyst Center Enablement](https://iptel.com.au/cisco-catalyst-center-enablement) - [About](https://iptel.com.au/about-us) IPTel Solutions - [About us](https://iptel.com.au/about-us) - [Job Applications](https://careers.iptel.com.au/job-application) - [Privacy Policy](https://iptel.com.au/privacy-policy) - [Careers Blog](https://careers.iptel.com.au) Contact Us - [Contact Us Form](https://iptel.com.au/contact-us) - [Email Us](mailto:sales@iptel.com.au) Customer - [Customer Feedback](https://iptel.com.au/customer-feedback) - [Customer Referral](https://iptel.com.au/customer-referral) - [Terms and Conditions](https://iptel.com.au/terms-and-conditions) News Stories - [Project Guardian uses Networking Infrastructure as a Sensor](https://www.dailytelegraph.com.au/news/nsw/transport-for-nsw-launches-worldfirst-sensor-trial-to-stop-rail-and-bridge-trespassers/news-story/8dc52e8fbca4c471da408e670cf0163e) - [IPTel partners for monitoring for Meeting Rooms as a Service](https://www.commsbusiness.co.uk/content/news/highlight-partners-with-iptel-solutions) - [Webex Monitoring with Highlight](https://itbrief.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [ITBrief with Meeting Room Monitoring](https://itbrief.com.au/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [Cisco Webex Meeting Rooms Monitoring](https://telconews.co.uk/story/highlight-iptel-add-webex-monitoring-for-meeting-rooms) - [IPTel adopts Highlight](https://itbrief.com.au/story/iptel-adopts-highlight-to-enhance-managed-services) - [Highlight MSP Upgrade](https://datacentre.solutions/news/71753/iptel-solutions-upgrade-with-highlights-service-platform) - [Cisco 360](https://www.crn.com.au/news/2026/networking/aussie-partners-react-cisco-360) - [DP World Transformation](https://www.cisco.com/site/us/en/about/case-studies-customer-stories/dp-world.html) - [Cisco Managed Services](https://www.arnnet.com.au/article/1251771/how-partners-can-take-a-leap-of-faith-with-managed-services.html) - [Project Delivery Excellence](https://channellife.com.au/story/cisco-honours-top-nz-partners-cisco-live) - [Great Place to Work](https://greatplacetowork.com.au/companies/iptel-solutions/) - [Wi-Fi Doesn't have to be Unreliable](https://www.techpartner.news/feature/iptel-wi-fi-doesnt-have-to-be-unreliable-494069) Buying from IPTel - [Buying Panels](https://iptel.com.au/professional-supply-panels) - [IPTel Store](https://store.iptel.com.au) - [Request a Quote](https://iptel.com.au/request-a-quote) - [Managed Services](https://iptel.com.au/managed-services-enquiry) Case Studies - [DP World Video](https://blog.iptel.com.au/hubfs/Case%20Studies/DP%20World_Case_Study.mp4) - [DP World](https://blog.iptel.com.au/dp-world-case-study) - [Backup Assure](https://blog.iptel.com.au/backup-assure-a-disaster-recovery-case-study) [Contact Us](https://iptel.com.au/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. ## Discover Connected Devices with Splunk Mar 1, 2026 Splunk helps businesses turn raw data into usable insights. In this case study we have used Splunk to help a major customer to quickly identify devices connected to the network. A simple but elegant dashboard makes that data easy to understand and use. ![Copy of Cisco AuHow Splunk Helps Businesses Discover Connected Devices](https://blog.iptel.com.au/hs-fs/hubfs/How%20Splunk%20Helps%20Businesses%20Discover%20Connected%20Devices/Copy%20of%20Cisco%20AuHow%20Splunk%20Helps%20Businesses%20Discover%20Connected%20Devices.gif?width=1792&height=960&name=Copy%20of%20Cisco%20AuHow%20Splunk%20Helps%20Businesses%20Discover%20Connected%20Devices.gif) As a quick intro, in case you're not familiar with Splunk, Splunk is a tool that allows ingestion of logs and other information, allowing you to cross correlate across more than one source and run queries on the data. Think of this as a SIEM - but Splunk offers much more than this, but that's a good starting point to envisage what it can do. Related reading - [Splunk Services from IPTel](https://iptel.com.au/splunk) - [What is Splunk](https://blog.iptel.com.au/splunk) - [Cisco Catalyst Center Overview](https://blog.iptel.com.au/cisco-catalyst-center-overview) - [Cisco Catalyst Center Deployment](https://blog.iptel.com.au/cisco-catalyst-center-deployment-tips) --- ## The Connected Device Audit Problem Many businesses have a need to keep track of the devices connected to their networks. With many devices being mobile (connected on Wi-Fi) that move around a lot, or that users have the ability to plug a device into any wall outlet, the question of what is connected could change on a daily basis. This audit needs to be dynamic: we need to poll the network and via various sources of information, correlate what’s connected. Here’s where Splunk can help. Related reading - [ThousandEyes Managed Services](https://blog.iptel.com.au/thousandeyes-managed-services) - [Cisco SDA Architecture](https://blog.iptel.com.au/cisco-sda-architecture) - [Splunk Healthcare Case Study](https://blog.iptel.com.au/splunk-healthcare-case-study) --- ## Splunk Information Sources Determining what devices are connected to your network is never quite as easy as it seems. There are a lot of places you can pull data from: - **DHCP records:** What devices have requested an IP Address - **Cisco Catalyst Center:** If managing switching and wireless controllers, you can use Catalyst Center to export connected client details - **Switch Polling:** Direct polling of the switch can show what’s connected – and using Cisco CDP you may be able to see what’s at the far end of any links - **Log Files:** Log files produced by a range of network devices can be used to help determine when clients have connected or disconnected Splunk can use all these information sources and after ingesting these, we can run queries. Those queries can be made accessible by use of dashboards or ITSI Glass Table views. Related reading - [Meraki Site-to-Site VPN](https://blog.iptel.com.au/meraki-site-to-site-vpn) - [Meraki Managed Service](https://blog.iptel.com.au/meraki-managed-service) --- ## The Cisco Catalyst Center API One of the most valuable sources of information for us in working out what’s connected is via Cisco Catalyst Center. In the screenshot below, we can see the data we have available via the API – and the ability for us to search this data. Since we’re connected to the API, this is live data – anything new gets plugged in and we can find it with a simple search for recently connected devices: ![Catalyst Center API](https://blog.iptel.com.au/hs-fs/hubfs/image-png-Feb-25-2026-05-43-12-9822-AM.png?width=1187&height=733&name=image-png-Feb-25-2026-05-43-12-9822-AM.png) Related reading - [Cisco Catalyst Center Enablement](https://blog.iptel.com.au/cisco-catalyst-center-enablement) - [xFSU - Extended Fast Upgrade](https://blog.iptel.com.au/extended-fast-software-update-xfsu) --- ## What if you don’t have API Access? Although a lot less elegant, if no API access is available for ingesting live data, we can make use of data uploaded into Splunk. This could be via a periodic export from an end system and import into Splunk. In the example below, we are ingesting a sample export from Catalyst Center: you can see all the options for the Events that we might want to filter on, so we can be quite granular in our search for those connected devices: ![Ingesting an export from Catalyst Center ](https://blog.iptel.com.au/hs-fs/hubfs/image-png-Feb-25-2026-05-43-25-2647-AM.png?width=404&height=483&name=image-png-Feb-25-2026-05-43-25-2647-AM.png) Related reading - [Cisco Catalyst Center Assurance](https://blog.iptel.com.au/blog/cisco-catalyst-center-assurance) - [5 Ways Catalyst Center Solves your Challenges](https://info.iptel.com.au/cisco-dna) --- ## How does Splunk Interconnect? We need to pull data from our sources and connect these into Splunk. Once our data is ingested, we can run our queries, but how do we get that data into Splunk in the first place? To solve this problem we install a Splunk Forwarder. This is connected to our instance of Splunk and we then set the end devices to connect to it. This may be devices sending SNMP traps, NetFlow, logfiles and so on – or connected via an API. The Forwarder then does the magic of connecting this inbound data to Splunk for us. A flexible and elegant solution. Related reading - [Cisco Spaces Introduction](https://blog.iptel.com.au/cisco-spaces-introduction) - [Cisco Spaces Applications](https://blog.iptel.com.au/cisco-spaces-applications) --- ## Data Dashboard In the lab image below, we can see the overview of the data. This is an easy-to-use dashboard that’s taken data from an API and displayed it in an accessible format. The data can now be filtered – we’ve put in a filter to view all Apple devices and the data below shows the specific detail on those: ![Viewing the connected device vendor](https://blog.iptel.com.au/hs-fs/hubfs/image-png-Feb-25-2026-05-43-44-2908-AM.png?width=2170&height=1021&name=image-png-Feb-25-2026-05-43-44-2908-AM.png) Related reading - [Unleashing the Power of Cisco XDR](https://blog.iptel.com.au/unleashing-the-power-of-cisco-xdr) - [Cisco Secure Access (SSE)](https://blog.iptel.com.au/cisco-secure-access-protect-your-hybrid-workforce-with-cloud-agile-security) --- ## Splunk Next Steps What are the next steps? Really that depends on what you want to extract from the data. Adding some rules means we can extract data that meets those rules – this could be looking for suspicious devices for example: - Tell me all the devices that have been connected via wired, but change port frequently - Show me all the Wi-Fi devices that move between sites - Examine if the same MAC address appears at the same time on two different switches As for the visuals, Splunk has its Dashboard Studio to be able to generate ITSI Glass tables, such as the one shown below. This allows us to overlay our live data onto maps and other images, which makes this a really visually appealing option: ![Splunk Healthcare Glass Table](https://blog.iptel.com.au/hs-fs/hubfs/Splunk%20Healthcare%20Glass%20Table.png?width=1536&height=1024&name=Splunk%20Healthcare%20Glass%20Table.png) Sample Render of a Splunk ITSI Dashboard Related reading - [Cisco Secure Network Analytics](https://blog.iptel.com.au/cisco-secure-network-analytics) - [Workspace usage with Cisco Spaces](https://info.iptel.com.au/cisco-dna) --- ## How Splunk Helps Businesses Discover Connected Devices: Summary Thanks for taking the time to read our case study on how we have used Splunk to help a key customer visualise what’s connected to their network in real time. This real-world use case shows a range of Splunk capabilities, but also how Splunk integrates with the business outcomes many companies have to deliver. A key takeaway from this blog is that once we have the connections in place and are ingesting data, we can start to add more sources of data and make more correlations. There are multiple teams that could end up using the data and enriching that data makes it more useful. If you’d like to chat over all things Splunk, or have any Splunk projects we could help you with, drop us a line at [sales@iptel.com.au](mailto:sales@iptel.com.au) Related reading - [Cisco Meraki Access Points](https://blog.iptel.com.au/cisco-meraki-access-points) - [Cisco Meraki Switching](https://blog.iptel.com.au/cisco-meraki-switching) - [Meraki Made Simple](https://blog.iptel.com.au/blog/meraki-made-simple-meet-dave) #### Related Articles ###### [Splunk Healthcare Case Study](https://blog.iptel.com.au/splunk-healthcare-case-study) Mar 3, 2026 ###### [Industrial IoT](https://blog.iptel.com.au/industrial-iot) Mar 31, 2026 ###### [Splunk](https://blog.iptel.com.au/splunk) Jan 20, 2026 Free tool ### How Many Wi-Fi Access Points Do You Need? Work out APs, PoE and switch ports floor by floor, using the same survey grades our Cisco wireless engineers design to. Takes under a minute. [Try the AP Estimator →](https://iptel.com.au/resources/wifi-access-point-estimator?utm_source=blog&utm_medium=cta&utm_campaign=ap-estimator) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "IPTel Solutions", "url" : "https://blog.iptel.com.au/author/iptel-solutions" }, "dateModified" : "2026-10-03T07:43:29.814Z", "datePublished" : "2026-03-01T03:28:49.000Z", "headline" : "Discover Connected Devices with Splunk", "image" : [ "https://blog.iptel.com.au/hubfs/How%20Splunk%20Helps%20Businesses%20Discover%20Connected%20Devices/Copy%20of%20Cisco%20AuHow%20Splunk%20Helps%20Businesses%20Discover%20Connected%20Devices%20(Instagram%20Post).gif" ], "mainEntityOfPage" : { "@id" : "https://blog.iptel.com.au/how-splunk-helps-businesses-discover-connected-devices", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.iptel.com.au/hubfs/IPTel_Solutions_February2020%20-%20Header%20SiteMap/Images/IPTellogo-byline-2020-dark-v2.png" }, "name" : "IPTel Solutions Pty Ltd" } } ```