All Apps and Add-ons

Using Sankey Diagram for Process Parent-Child Mapping

Path Finder

I've downloaded the Sankey Visualisation with the goal of mapping Windows 4688 Events in a way that gives a sort of "process tree" for parents and children processes. This works fine for small volumes of data, but is unusable where it comes to a busy workstation:

alt text

I started looking at filtering - ideally you'd be able to specify the process name, like "cmd.exe" and see all related parent and child processes for processes with that process name, however that implicitly excludes anything that doesn't have that process name - meaning you lose all parent and child processes that aren't also called "cmd.exe".

The only way I can see around this is to exclude by PID - this is a painful process at the best of times, as you've got to go through the diagram and write down each individual PID to exclude, before it removes enough events to be able to view in sufficient detail. Not to mention it's literally impossible if your starting point is a diagram as above.

Can anyone see a way around this? The logic would be "where process name = "blah", map out all child processes recursively". That doesn't seem to be possible here.

The search syntax I've been using (including process exclusion):

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| stats count(ProcessID) by parent child

Producing events like this which are mapped in the Sankey Diagram:

10028 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 8596 - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe 1
10052 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 10256 - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 1

0 Karma

New Member

I recently published app that might work for your situation.


App just implements a pstree command. You can filter for trees with specific processes after calling the pstree command.

index=wineventlog host=TEST EventCode=4688 NOT ProcessID IN (18104,1176,4468,9924)
| eval parent=ProcessID." - ".ParentProcessName 
| eval child=NewProcessID." - ".NewProcessName
| pstree child=child parent=parent | table tree
| search tree=*<pid process of interest>

This command generally handles a single host fine but there is a recursion limit in Splunk that sometimes causes command to fail.

0 Karma

Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...