Splunk search to check the sysmon process if not running

[sekhar463]

hai all,

i am using below splunk search to know the status if not running 

but its not giving if process was not running.

sourcetype=ps host=test1 COMMAND=*event_demon*
| stats latest(cpu_load_percent) as "CPU %", latest(PercentMemory) as "MEM %", latest(RSZ_KB) as "Resident Memory (KB)", latest(VSZ_KB) as "Virtual Memory (KB)" by _time
| eval Process_Status = case(isnotnull('CPU %') AND isnotnull('MEM %'), "Running", isnull('CPU %') AND isnull('MEM %'), "Not Running", 1=1, "Unknown")
| table "CPU %", "MEM %", "Resident Memory (KB)", "Virtual Memory (KB)", Process_Status
| eval Process_Status = coalesce(Process_Status, "Unknown")
| rename "CPU %" as "CPU %", "MEM %" as "MEM %"
| fillnull value="N/A"

[isoutamo]

Hi

Splunk is not good to find something with is not existing. There are some ways to do it. Some of those are presented at https://www.duanewaddle.com/proving-a-negative/

One way to do it in your case is a create e.g. lookup which contains those processes which must be running. Then append this to your search and stats count by host + process and if count = 1 then it didn't run.

r. Ismo

[sekhar463]

the search gives me for running but not getting how to get for if process not running

[isoutamo]

You should have a lookup or other way add those processes which must to run with append to your base search. Then do stats count by computer + process and if count = 1 this means that there is not running process (just that which you have appended). If count > 1 then there is also running. So select those where count is 1 and you will get those where this is not running.

Something like this

index=os_unix_audit PID=* COMMAND=ps
| append
    [makeresults
    | eval host="splunk-demo-rh8.local", COMMAND="ps1"
    | fields host, COMMAND, added]
| stats count by host, COMMAND
| where count = 1