Hi, this is a bit generic question. One thing that i would do is
1) Identify to which index is the network logs going
2) Whitelist all known devices into a lookup file
3) create an alert using a search which compares the host names and alert if it sees any new device.
If you have some sample events i can help with search, also look in Splunk base if you can find a related app which can do this for you.
