https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-trace-process-tree-descendants/m-p/435503#M5752 <P>I have windows and UNIX process start data in a logfile, including start time, process ID, and parent process ID. I want to be able to identify a specific process entry, and return all entries that are its descendants (children, grandchildren, great grandchildren, etc.), from the start time of the initial process to the present.</P> <P>Because we're not tracking process termination, the reuse of a process ID, as indicated by a new process start event for one of the parent process IDs currently being traced, but without that new process's parent process ID being a different member of the set being traced, should result in removal of that new process ID from the trace set going forward from that point.</P> Wed, 12 Dec 2018 19:41:50 GMT johnmccash 2018-12-12T19:41:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-trace-process-tree-descendants/m-p/435503#M5752 <P>I have windows and UNIX process start data in a logfile, including start time, process ID, and parent process ID. I want to be able to identify a specific process entry, and return all entries that are its descendants (children, grandchildren, great grandchildren, etc.), from the start time of the initial process to the present.</P> <P>Because we're not tracking process termination, the reuse of a process ID, as indicated by a new process start event for one of the parent process IDs currently being traced, but without that new process's parent process ID being a different member of the set being traced, should result in removal of that new process ID from the trace set going forward from that point.</P> Wed, 12 Dec 2018 19:41:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-trace-process-tree-descendants/m-p/435503#M5752 johnmccash 2018-12-12T19:41:50Z