All Apps and Add-ons

Using Sankey Diagram for Process Parent-Child Mapping

Path Finder

I've downloaded the Sankey Visualisation with the goal of mapping Windows 4688 Events in a way that gives a sort of "process tree" for parents and children processes. This works fine for small volumes of data, but is unusable where it comes to a busy workstation:

alt text

I started looking at filtering - ideally you'd be able to specify the process name, like "cmd.exe" and see all related parent and child processes for processes with that process name, however that implicitly excludes anything that doesn't have that process name - meaning you lose all parent and child processes that aren't also called "cmd.exe".

The only way I can see around this is to exclude by PID - this is a painful process at the best of times, as you've got to go through the diagram and write down each individual PID to exclude, before it removes enough events to be able to view in sufficient detail. Not to mention it's literally impossible if your starting point is a diagram as above.

Can anyone see a way around this? The logic would be "where process name = "blah", map out all child processes recursively". That doesn't seem to be possible here.

The search syntax I've been using (including process exclusion):

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| stats count(ProcessID) by parent child

Producing events like this which are mapped in the Sankey Diagram:

10028 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 8596 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 1
10052 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 10256 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 1

0 Karma

New Member

I recently published app that might work for your situation.


App just implements a pstree command. You can filter for trees with specific processes after calling the pstree command.

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| pstree child=child parent=parent | table tree
| search tree=*<pid process of interest>

This command generally handles a single host fine but there is a recursion limit in Splunk that sometimes causes command to fail.

0 Karma

Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...