topic Re: Splunk query using azure KQL data with concatenation in Splunk Search https://community.splunk.com/t5/Splunk-Search/Splunk-query-using-azure-KQL-data-with-concatenation/m-p/690726#M235244 <P>Really nobody who came across this issue?&nbsp;</P> Fri, 14 Jun 2024 13:10:43 GMT heskez 2024-06-14T13:10:43Z Splunk query using azure KQL data with concatenation https://community.splunk.com/t5/Splunk-Search/Splunk-query-using-azure-KQL-data-with-concatenation/m-p/690619#M235202 <P><SPAN>Hi there,</SPAN></P><P>I am trying to get some data from MS Defender into a Splunk query.&nbsp;</P><P><SPAN>My original KQL query in azure contains | JOIN KIND INNER. to concat DeviceProcess and DeviceRegistry tables.</SPAN></P><P>The Splunk app I am using:&nbsp;</P><P><SPAN>Splunk&nbsp;<A class="" href="https://splunkbase.splunk.com/app/5518" target="_blank" rel="noopener noreferrer nofollow">https://splunkbase.splunk.com/app/5518</A>&nbsp;</SPAN></P><P>&nbsp;</P><P><SPAN>So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt in splunk SPL. Is there a suitable Splunk query for this kind of purpose?</SPAN></P> Thu, 13 Jun 2024 13:44:20 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-using-azure-KQL-data-with-concatenation/m-p/690619#M235202 heskez 2024-06-13T13:44:20Z Re: Splunk query using azure KQL data with concatenation https://community.splunk.com/t5/Splunk-Search/Splunk-query-using-azure-KQL-data-with-concatenation/m-p/690726#M235244 <P>Really nobody who came across this issue?&nbsp;</P> Fri, 14 Jun 2024 13:10:43 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-using-azure-KQL-data-with-concatenation/m-p/690726#M235244 heskez 2024-06-14T13:10:43Z