I'd create a report, summarize by Event Count and select only device.ip then group by device.ip. You can narrow down your search by adding to the where clause.
This report should give you all the devices that are reporting to SA and tell how many logs per device IP. If the device isn't logging to SA then the IP will not display on this report. I actually have this run as a report each morning. I'll explain.
In our setup we have 6 VLC's that report to the LC exclusively. So my morning report shows how many logs are being sent to the LC (All the VLC's combined) as well as how many logs each VLC collects. From there, I have a list of the VLC's and all the IP's ordered by log count. For example...
Total logs: 30,000,000
Device Name : Log Count
VLC 1: 5,000,000
VLC 2: 5,000,000
VLC 3: 5,000,000
VLC 4: 5,000,000
VLC 5: 5,000,000
VLC 6: 5,000,000
VLC1 -
IP address 1 : 1,000,000
IP address 2 : 1,000,000
IP address 3 : 1,000,000
VLC2 -
IP address 1 : 1,000,000
IP address 2 : 1,000,000
IP address 3 : 1,000,000
You probably get the point. I find this to be a pretty useful report.
Hope this helps.
-Rob
