Splunk Search

How to group IP address subnets to build an average duration by subnet range?

matt4321
Explorer

I am using a search to get the average Sessions Duration for my Windows security event logs. I want to take the below a step further and build average duration's by Subnet Ranges.

Starting search currently is:

index=mswindows host=* Account_Name=* | transaction Logon_ID startswith=EventCode=4624 endswith=EventCode=4634 | eval duration=duration/60

From here I am able to avg durations by Account_Name, Hostname etc..

I would like to now group by subnet range from the SourceIP field:
10.144.50.0/23 as Citrix Internal
10.144.11.0/23 as Citrix External

I don't mind putting in the octets for each Citrix Internal or External etc..

Any help would be appreciated!

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

You can use he cidrmatch function and label your IPs:

| eval subnet = case (cidrmatch("10.144.50.0/23",YourIPField), "CitrixInternal", cidrmatch("10.144.11.0/23",YourIPField), "CitrixExtrernal")

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

You can use he cidrmatch function and label your IPs:

| eval subnet = case (cidrmatch("10.144.50.0/23",YourIPField), "CitrixInternal", cidrmatch("10.144.11.0/23",YourIPField), "CitrixExtrernal")
0 Karma

matt4321
Explorer

Actually to keep this simple I really only need 4 subnets.
So IP's 10.144.50.* and 10.144.51.* = Citrix Internal
and IP's 10.144.11.* and 10.144.12.* = Citrix External

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...