Splunk Search

Need help with Splunk query to merge subsearch with main search

Loves-to-Learn Lots


I am trying to craft a query that will look for Windows devices that have been rebooted and then have accessed a certain file path to launch a service. I have attempted this by creating a subsearch for the windows eventid 6005 (reboot), and then passing the computer name associated with that event to the main search for devices that have accessed a filepath. I am not sure how to obtain an output that will show the computer name of a device that has recently had a reboot and also has accessed the file path.

Thank you for any help, I am new to Splunk subsearches and appreciate any pointers.

index=wineventlog Creator_Process_Name="C:\\Program Files\\XXX\\YYY\\file.exe"
[search index=wineventlog  ComputerName="*xyz.local"  EventCode="6005" | stats count by ComputerName, EventCode | fields ComputerName, EventCode]
|stats values (?) by EventCode


Labels (2)
0 Karma


Try something like this

index=wineventlog ComputerName="*xyz.local" (EventCode="6005" OR Creator_Process_Name="C:\\Program Files\\XXX\\YYY\\file.exe")
|stats values(*) as * by ComputerName
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...