Splunk Search

Azure defender advanced hunting to Splunk SPL

heskez
Engager
I am having an issue in Advanced hunting for Defender app in Splunk https://splunkbase.splunk.com/app/5518 My original KQL query in azure contains | JOIN KIND INNER. Is such syntax also possible in SPL?
 
 
 
 
 
 
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, SPL has a join command, but it should be avoided because it doesn't perform well.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Join

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

heskez
Engager

Thanks for your answer. I'm not sure if this is what I want. Because the advanced hunting app requires an API call with a limit of calls, I start doing a call on DeviceProcessEvents. Then I'm not sure if I need to do another API call on DeviceRegistryEvents, since I'd like to joint these two instances. 

0 Karma

heskez
Engager

So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...