Create a New field on an event by evaluating two different event values

[CryoHydra]

Hello Splunkers,

Facing one issue in identifying Creator_Process_Name,

In windows process creation event we have New_Process_ID, New_Process_Name, Creator_Process_ID -- using this we cannot identify Process which created the New_Process_Name , but there is a chance where Creator_Process_ID=New_Process_ID in some other event so from that event i need to populate Creator_Process_Name

For e.g

index=wineventlog hostname1 |eval Creator_Process_Name=if(Creator_Process_ID=="New_Process_ID", New_Process_Name,NULL) 

[woodcock]

Show us sample events and a mockup of the desired output.

[tiagofbmm]

Seems what you're looking for is a straight comparison between the two fields, not one field compared to a string:

index=wineventlog hostname1 |eval Creator_Process_Name=if(Creator_Process_ID==New_Process_ID, New_Process_Name,NULL)

What do you think ?

[CryoHydra]

Yes you are right, but this query is not creating Creator_Process_Name field.

[tiagofbmm]

If this field is not created, it's one of two cases:

1 - either Creator_Process_ID or New_Process_ID fields do not exist
2 - Creator_Process_ID is never equal to New_Process_ID

In any of the two cases, Creator_Process_Name will be null for all the events, and so the field doesn't event get "created" (shown).

Please check those cases.

P.S. This is how I'd put the query anyway.
index=wineventlog hostname1 |eval Creator_Process_Name=if(Creator_Process_ID=New_Process_ID, New_Process_Name,null())