You might want a comprehensive list of virtual networks in your environment when doing the following:
Prerequisites
In order to execute this procedure in your environment, the following data, services, or apps are required:
- Microsoft Azure virtual machine data
- Splunk Add-on for Microsoft Cloud Services
Example
As an administrator, you want to have a high-level view of virtual networks in your Azure infrastructure.
NOTE: To optimize the search shown below, you should specify an index and a time range.
- Run the following search:
sourcetype="mscs:resource:virtualNetwork"
|stats count BY location, properties.subnets{}.name, properties.addressSpace.addressPrefixes{}, name
|fields - count
|rename location AS Location name AS "Source Network", properties.subnets{}.name AS Name properties.addressSpace.addressPrefixes{} AS Subnet
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
Splunk Search |
Explanation |
sourcetype="mscs:resource:virtualNetwork" |
Search only Azure virtual networks data. |
|stats count BY location, properties.subnets{}.name, properties.addressSpace.addressPrefixes{}, name |
Count the number of instances for a combination of location, name, subnet, and source network. Return one row for each distinct combination of values. |
|fields - count |
Remove the count field from the results. |
|rename location AS Location name AS "Source Network", properties.subnets{}.name AS Name properties.addressSpace.addressPrefixes{} AS Subnet |
Rename the fields as shown for better readability. |
Result
Sample results for this search are shown in the table below. The results show all the virtual networks provisioned in the environment. This data could be the foundation for asset management data collection. Inventory and asset management tracking is considered a best practice in the ITIL framework. A search like this can be used to gather information on provisioned assets, in this case virtual networks. Asset management is critical in the cloud because it affects operation expenses, as well as security, and informs lifecycle management.
Location |
Name |
Subnet |
Source Network |
australiaeast |
default |
10.0.2.0/24 |
botsvnet419 |
australiaeast |
default |
10.0.4.0/24 |
conf19-vnet |
australiaeast |
default |
10.0.5.0/24 |
frothlyvnet616 |
australiasoutheast |
default |
10.0.0.0/24 |
bots-vnet |
australiasoutheast |
splunk |
10.1.0.0/16 |
splunk |
Comments
0 comments
Please sign in to leave a comment.