Dashboards & Visualizations

Any good Viz for process correlation

jbanAtSplunk
Communicator

Hi,

If I have process Events like

PID | ProcessName |  CommandLine | SpawnedByPID
100 | process_1 | process_1_commandLine | 99
101 | process_2 | process_2_commandLine | 100
200 | process_3 |  process_3_commandLine | 199
201 |  process_4 |  process_4_commandLine | 200

Is there any Viz that will map processes in some Folder/EDR like tree (where I can also click on node and get mora info).
For example, final results are based on PID but Viz looks like something like
| -> process_name_99
|----> process_1 (on hower or Click will get token process_1_commandLine)
|--------> process_2

| -> process_name_99
|----> process_3
|-------->process_4

Something like psTree just more advanced and connected by PID not names.

Labels (4)
0 Karma

_JP
Contributor

Sounds like you need this app from Splunkbase:

Treeview Viz | Splunkbase

Tags (1)
0 Karma

jbanAtSplunk
Communicator

It's good app but not good enough 😞 
Missing few additional fields. 

For example:
Parent_Process_Label (at least). <<< always Parent_Process_PID is "folder name". 

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...