How to group IP address subnets to build an average duration by subnet range?

[matt4321]

I am using a search to get the average Sessions Duration for my Windows security event logs. I want to take the below a step further and build average duration's by Subnet Ranges.

Starting search currently is:

index=mswindows host=* Account_Name=* | transaction Logon_ID startswith=EventCode=4624 endswith=EventCode=4634 | eval duration=duration/60

From here I am able to avg durations by Account_Name, Hostname etc..

I would like to now group by subnet range from the SourceIP field:
10.144.50.0/23 as Citrix Internal
10.144.11.0/23 as Citrix External

I don't mind putting in the octets for each Citrix Internal or External etc..

Any help would be appreciated!

[javiergn · Accepted solution]

You can use he cidrmatch function and label your IPs:

| eval subnet = case (cidrmatch("10.144.50.0/23",YourIPField), "CitrixInternal", cidrmatch("10.144.11.0/23",YourIPField), "CitrixExtrernal")

[matt4321]

Actually to keep this simple I really only need 4 subnets.
So IP's 10.144.50.* and 10.144.51.* = Citrix Internal
and IP's 10.144.11.* and 10.144.12.* = Citrix External