Skip to main content
 
 
 
Splunk Lantern

Inventory of Azure virtual networks

 

As an administrator, you want to have a high-level view of virtual networks in your Azure infrastructure. 

Data required 

Microsoft: Azure virtual machine data

Procedure

  1. Configure the Splunk Add-on for Microsoft Cloud Services.
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype="mscs:resource:virtualNetwork"
|stats count BY location, properties.subnets{}.name, properties.addressSpace.addressPrefixes{}, name 
|fields - count 
|rename location AS Location name AS "Source Network", properties.subnets{}.name AS Name properties.addressSpace.addressPrefixes{} AS Subnet

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype="mscs:resource:virtualNetwork"

Search only Azure virtual networks data. 

|stats count BY location, properties.subnets{}.name, properties.addressSpace.addressPrefixes{}, name
 

Count the number of instances for a combination of location, name, subnet, and source network. Return one row for each distinct combination of values. 

|fields - count
 

Remove the count field from the results. 

|rename location AS Location name AS "Source Network", properties.subnets{}.name AS Name properties.addressSpace.addressPrefixes{} AS Subnet

Rename the fields as shown for better readability.

Next steps

Sample results for this search are shown in the table below. The results show all the virtual networks provisioned in the environment. This data could be the foundation for asset management data collection. Inventory and asset management tracking is considered a best practice in the ITIL framework. A search like this can be used to gather information on provisioned assets, in this case virtual networks. Asset management is critical in the cloud because it affects operation expenses, as well as security, and informs lifecycle management. 

Location Name Subnet Source Network

australiaeast

default

10.0.2.0/24

botsvnet419

australiaeast

default

10.0.4.0/24

conf19-vnet

australiaeast

default

10.0.5.0/24

frothlyvnet616

australiasoutheast

default

10.0.0.0/24

bots-vnet

australiasoutheast

splunk

10.1.0.0/16

splunk

You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.