Splunk Search
Highlighted

How to group IP address subnets to build an average duration by subnet range?

Explorer

I am using a search to get the average Sessions Duration for my Windows security event logs. I want to take the below a step further and build average duration's by Subnet Ranges.

Starting search currently is:

index=mswindows host=* Account_Name=* | transaction Logon_ID startswith=EventCode=4624 endswith=EventCode=4634 | eval duration=duration/60

From here I am able to avg durations by Account_Name, Hostname etc..

I would like to now group by subnet range from the SourceIP field:
10.144.50.0/23 as Citrix Internal
10.144.11.0/23 as Citrix External

I don't mind putting in the octets for each Citrix Internal or External etc..

Any help would be appreciated!

0 Karma
Highlighted

Re: How to group IP address subnets to build an average duration by subnet range?

Explorer

Actually to keep this simple I really only need 4 subnets.
So IP's 10.144.50.* and 10.144.51.* = Citrix Internal
and IP's 10.144.11.* and 10.144.12.* = Citrix External

0 Karma
Highlighted

Re: How to group IP address subnets to build an average duration by subnet range?

SplunkTrust
SplunkTrust

You can use he cidrmatch function and label your IPs:

| eval subnet = case (cidrmatch("10.144.50.0/23",YourIPField), "CitrixInternal", cidrmatch("10.144.11.0/23",YourIPField), "CitrixExtrernal")

View solution in original post

0 Karma