Splunk Search

Splunk query using azure KQL concat

heskez
Engager

Hi there,

I am trying to get some data from MS Defender into a Splunk query. 

My original KQL query in azure contains | JOIN KIND INNER. to concat DeviceProcess and DeviceRegistry tables.

The Splunk app I am using: 

Splunk https://splunkbase.splunk.com/app/5518 

 

So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt in splunk SPL. Is there a suitable Splunk query for this kind of purpose?

Labels (1)
0 Karma
1 Solution

KendallW
Contributor

Hi @heskez try using the join command:

<left-dataset> | join left=L right=R 
where L.pid = R.pid <right-dataset>

 https://docs.splunk.com/Documentation/SCS/current/SearchReference/JoinCommandOverview 

View solution in original post

0 Karma

KendallW
Contributor

Hi @heskez try using the join command:

<left-dataset> | join left=L right=R 
where L.pid = R.pid <right-dataset>

 https://docs.splunk.com/Documentation/SCS/current/SearchReference/JoinCommandOverview 

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...