Hi, I'm doing a project and I've installed Splunk Trial Enterprise on a server and Universal Forwarder on other three servers (with Ubuntu) that sends me logs. On forwarders exist a script that sends me logs of every processes that's running on server. I would to create a dynamic list where logs of processes is added and tagged as "Well-Knowned Processes".   After that when new logs of processes come to indexer they are compared with logs on dynamic list and if the process was not recognized (doesn't exist in the list) the alert is triggered. I would to do that to check suspicious process. Thanks    ... View more