Azure defender advanced hunting to Splunk SPL

[heskez]

I am having an issue in Advanced hunting for Defender app in Splunk https://splunkbase.splunk.com/app/5518 My original KQL query in azure contains | JOIN KIND INNER. Is such syntax also possible in SPL?

[richgalloway]

Yes, SPL has a join command, but it should be avoided because it doesn't perform well.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Join

[heskez]

Thanks for your answer. I'm not sure if this is what I want. Because the advanced hunting app requires an API call with a limit of calls, I start doing a call on DeviceProcessEvents. Then I'm not sure if I need to do another API call on DeviceRegistryEvents, since I'd like to joint these two instances. 

[heskez]

So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt