Skip to main content
Splunk Lantern

List of Azure resource public IP addresses

You might want a comprehensive list of IP addresses in your environment when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

As an administrator, you want to have a high-level view of the number of IP addresses in your Azure infrastructure, as well as their location and allocation method.

To optimize the search shown below, you should specify an index and a time range.

  1. Run the following search: 
sourcetype="mscs:resource:publicIPAddress"
|stats count BY location, name, properties.publicIPAddressVersion, properties.publicIPAllocationMethod 
|fields - count
|rename location AS Location name AS Name properties.publicIPAddressVersion AS Version properties.publicIPAllocationMethod AS "Allocation Method"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype="mscs:resource:publicIPAddress"

Search only Azure resource public IP address data. 

|stats count BY location, name, properties.publicIPAddressVersion, properties.publicIPAllocationMethod 

Count the number of instances for a combination of location, IP address, version, and allocation method. Return one row for each distinct combination of values. 

|fields - count 

Remove the count field from the results. 

|rename location AS Location name AS Name properties.publicIPAddressVersion AS Version properties.publicIPAllocationMethod AS "Allocation Method"

Rename the fields as shown for better readability.

Result

Sample results for this search are shown in the table below. The results show all the public IP addresses provisioned in the environment. This data could be the foundation for asset management data collection. Inventory and asset management tracking is considered a best practice in the ITIL framework. A search like this can be used to gather information on provisioned assets, in this case virtual networks. Asset management is critical in the cloud because it affects operation expenses, as well as security, and informs lifecycle management.  Public IP addresses are not free. 

Location Name Version Allocation Me

australiaeast

CentOS-ip

IPv4

Dynamic

australiaeast

ChiefConverseOfficer-ip

IPv4

Static

australiaeast

Forum2019-ip

IPv4

Dynamic

australiaeast

RHEL-ip

IPv4

Dynamic

australiaeast

Test-ip

IPv4

Dynamic

  • Was this article helpful?