My company have a lot of remote sites, each site has so many IP subnets are duplicated I would like to ask if Splunk Enterprise Security is able to distinguish each remote site?
No. If you overlap IP space use in your assets, no system has a good way to know which IP-asset you mean. That problem is not unique to ES.
