All Apps and Add-ons

Windows performance data

bernardoortega
Path Finder

Hello,
I have enabled performance data from one windows hosts to test it.
If i search for index=windows i got 13 sources(process,service,inbound,outbound,disk,etc) and 4 different sourcetypes: (i have enabled listening ports and apps)
WinNetMon
WinHostMon
Script:ListeningPorts
Script:InstalledApps

Now, if i do a search like this:

index=windows sourcetype="Script:ListeningPorts" | dedup dest_port |table dest_port,process_id
I got the listening port number and thge process_id (pid) in a table.
If i want to see what the process_id=2220 is bound to which software i do this:

index=windows sourcetype=WinHostMon source=process ProcessId=2220 | table CommandLine

Will show me the pid 2220 and commandline, which is the Terminal service in this case

As you can see there are two fields: process_id and ProcessId with the same pid number.

I need to do a search in a table to show: dest_port, ProcessId,CommandLine

But as they are coming from different sourcetypes and sources i cannot figure it out how to do it.

thanks guys

0 Karma
1 Solution

adonio
Ultra Champion

hello bernardoortega,
I think a better headline to this question will be: "How to join 2 search results with no matching fields" or something of that sort.
with that being said, I relied here on a solution by @DalJeanis on a different question here: https://answers.splunk.com/answers/500980/how-to-join-two-searches-with-no-common-field.html
here is the search:

 index=windows sourcetype="Script:ListeningPorts" process_id=*
     | table process_id dest_port 
     | join type=left ProcessId 
       [
            | search index=windows sourcetype=WinHostMon source=process ProcessId=* 
            | stats count by  ProcessId CommandLine | rename ProcessId as process_id
        ]
     | table process_id dest_port CommandLine 

and here is a screenshot:
alt text

View solution in original post

adonio
Ultra Champion

hello bernardoortega,
I think a better headline to this question will be: "How to join 2 search results with no matching fields" or something of that sort.
with that being said, I relied here on a solution by @DalJeanis on a different question here: https://answers.splunk.com/answers/500980/how-to-join-two-searches-with-no-common-field.html
here is the search:

 index=windows sourcetype="Script:ListeningPorts" process_id=*
     | table process_id dest_port 
     | join type=left ProcessId 
       [
            | search index=windows sourcetype=WinHostMon source=process ProcessId=* 
            | stats count by  ProcessId CommandLine | rename ProcessId as process_id
        ]
     | table process_id dest_port CommandLine 

and here is a screenshot:
alt text

bernardoortega
Path Finder

You are right that the title should be named different. Anyway, it worked well, thanks so much for the info.

0 Karma

adonio
Ultra Champion

if that is the case,
kindly mark the question as answered
happy it works for you!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@adonio - Thanks for the shout out. Shouldn't line 3 be | join type=left process_id ?

I'm guessing that it worked only because ProcessId was null in both files and process_id existed with matching keys...

adonio
Ultra Champion

Yes, you are correct!
also missed the | dedup requirement in the search i question. so here it is again!

  index=windows sourcetype="Script:ListeningPorts" process_id=*
     | dedup process_id
     | table process_id dest_port 
      | join type=left process_id 
       [| search index=windows sourcetype=WinHostMon source=process ProcessId=* | stats count by  ProcessId CommandLine | rename ProcessId as process_id ]
     | table process_id dest_port CommandLine
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...