Skip to main content

 

Splunk Lantern

Azure resources with no associated tags

 

Using tags on resources allows an IT department to better organize cloud-based resources. Tags facilitate the identification of assets running specific work loads, department ownership, business process priority, and cost related information. Finding a large inventory of untagged assets is an important input for monitoring and managing tagging policy in the use of cloud based resources. You want to create a search to help your IT department do this.

Data required 

Microsoft Azure resource data​​​​​​​

Procedure

  1. Configure the Splunk Add-on for Microsoft Cloud Services.
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype=mscs:resource:* 
|search _raw!=*tags* 
|dedup id, name, location 
|table id, name, location tags.* 
|fillnull value="Untagged!"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype=mscs:resource:* 

Search only Azure resource data.

|search _raw!=*tags* 

Filter the results to only include those where the _raw field does not include “tags”. 

|dedup id, name, location 

Remove duplicate results by ID, name, and location.

|table id, name, location tags.* 

Display the results in a table with columns in the order shown.

|fillnull value="Untagged!"

Fill any null values with “Untagged!”

Next steps

Sample results for this search are shown in the table below. This search can serve as input to a potential automation process to assign tags or request owners to formulate and assign tags to their assets. Splunk SOAR could be used for such an automation project by putting the results of the search into a playbook that formats an email to the owner of the untagged asset requiring tagging to be put into place. Azure’s Cloud Adoption Framework contains a decision guide for resource naming and the use of tags. 

id name location tags.Owner tags.Purpose tags.service

/subscriptions/1213b189-13ff-42fe-b370-df6da421bce1/resourceGroups/frothly/providers/Microsoft.Network/publicIPAddresses/test-ip

test-ip

southcentralus

Untagged!

Untagged!

Untagged!

/subscriptions/1213b189-13ff-42fe-b370-df6da421bce1/resourceGroups/MineMeld/providers/Microsoft.Network/networkInterfaces/networkInterface1

networkInterface1

southcentralus

Untagged!

Untagged!

Untagged!

/subscriptions/1213b189-13ff-42fe-b370-df6da421bce1/resourceGroups/bots/providers/Microsoft.Compute/virtualMachines/Splunk

Splunk

australiasoutheast

Untagged!

Untagged!

Untagged!

/subscriptions/1213b189-13ff-42fe-b370-df6da421bce1/resourceGroups/bots/providers/Microsoft.Network/virtualNetworks/bots-vnet

bots-vnet

australiasoutheast

Untagged!

Untagged!

Untagged!

/subscriptions/1213b189-13ff-42fe-b370-df6da421bce1/resourceGroups/bots/providers/Microsoft.Network/networkInterfaces/splunk64

splunk64

australiasoutheast

Untagged!

Untagged!

Untagged!

You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.