Splunk Search

Splunk query using azure KQL concat

heskez
Engager

Hi there,

I am trying to get some data from MS Defender into a Splunk query. 

My original KQL query in azure contains | JOIN KIND INNER. to concat DeviceProcess and DeviceRegistry tables.

The Splunk app I am using: 

Splunk https://splunkbase.splunk.com/app/5518 

 

So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt in splunk SPL. Is there a suitable Splunk query for this kind of purpose?

Labels (1)
0 Karma
1 Solution

KendallW
Contributor

Hi @heskez try using the join command:

<left-dataset> | join left=L right=R 
where L.pid = R.pid <right-dataset>

 https://docs.splunk.com/Documentation/SCS/current/SearchReference/JoinCommandOverview 

View solution in original post

0 Karma

KendallW
Contributor

Hi @heskez try using the join command:

<left-dataset> | join left=L right=R 
where L.pid = R.pid <right-dataset>

 https://docs.splunk.com/Documentation/SCS/current/SearchReference/JoinCommandOverview 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...