Hello Splunkers, Facing one issue in identifying Creator_Process_Name, In windows process creation event we have New_Process_ID, New_Process_Name, Creator_Process_ID -- using this we cannot identify Process which created the New_Process_Name , but there is a chance where Creator_Process_ID=New_Process_ID in some other event so from that event i need to populate Creator_Process_Name For e.g index=wineventlog hostname1 |eval Creator_Process_Name=if(Creator_Process_ID=="New_Process_ID", New_Process_Name,NULL) ... View more

Hi, In incident review dashboard i have assigned some notables to me, instead of reviewing one by one i wanted to review events for all notables in single attempt through search app. e.g) Notable for excessive firewall deny rule - triggered for the time period 1AM to 5AM --> i need to review correlated/contributing events by opening the incident e.g) excessive failed logon - triggered for 3AM to 8AM both notable in incident review dash board is assigned to me and based on search properties i can get all notables assigned to me (search query) and can be used in search app, however i want to fetch contributing events for the notable in search app itself based on triggered time ? how can we go over this ? ... View more

In our SIEM team meeting had discussion like we have100+ splunk servers ? What does splunk server mean ? is it Splunk index alone or including heavy forwarders, deployment servers and search head ? It would be great to have list of components associated with splunk architecture and its functions with use case? ... View more

Hi, had facing issues in using join command , i have two search (sub-search, search)which needs to be joined together. sub search : "C:\Windows\System32\windows.exe" sourcetype=windows [search sourcetype=scanner | dedup FQDN | rename FQDN as ComputerName] |table Process ComputerName search sourcetype=scanner | dedup FQDN |rename FQDN as ComputerName |convert ctime(_time) as time |stats earliest(time) as et latest(time) as lt by ComputerName IP status Join both sub-search and search using ComputerName key "C:\Windows\System32\windows.exe" sourcetype=windows [search sourcetype=scanner | dedup FQDN | rename FQDN as ComputerName | table ComputerName] |table Process ComputerName |join type=outer ComputerName [search sourcetype=scanner | dedup FQDN |rename FQDN as ComputerName |convert ctime(_time) as time |stats earliest(time) as et latest(time) as lt by ComputerName IP status] ComputerName is extracted from the sourcetype=scanner which is used in both sub-search search but tabling of fields not happening as expected ? where i am making mistake ... View more