Splunk Enterprise Security

How to trace process tree/descendants


I have windows and UNIX process start data in a logfile, including start time, process ID, and parent process ID. I want to be able to identify a specific process entry, and return all entries that are its descendants (children, grandchildren, great grandchildren, etc.), from the start time of the initial process to the present.

Because we're not tracking process termination, the reuse of a process ID, as indicated by a new process start event for one of the parent process IDs currently being traced, but without that new process's parent process ID being a different member of the set being traced, should result in removal of that new process ID from the trace set going forward from that point.

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...