i tried entering this with a slight tweak to the query: index=wineventlog source=wineventlog:security EventCode IN (4663,4688) Process_Name="*welcome.exe" | stats earliest(_time) AS _time values(Object_Name) AS Object_Name BY ComputerName Process_Name | table _time ComputerName Object_Name Process_Name Initiating_Process_Name​ , however this is my result: _time ComputerName Object_Name Process_Name Initiating_Process_Name 2025-03-19 16:00 ABCDE object.exe welcome.exe (blank)   I am still not able to get all 3 columns (object name, process name, initiating process name) into the same table. ... View more

Many thanks for your reply. Maybe I could add some clarity to the exact results I want: First inner search: index=wineventlog source=wineventlog:security EventCode=4663 Object_Name="*hello.exe" Process_Name="*welcome.exe" | table _time ComputerName Object_Name Process_Name _time ComputerName Object_Name Process_Name 2025-03-19 12:00:00 ABCDE \ABC\hello.exe welcome.exe   Next, when I search EventCode=4688, this is a sample search and outcome: index=wineventlog source=wineventlog:security EventCode=4688 Process_Name="*welcome.exe" | table _time ComputerName Process_Name Initiating_Process_Name​ _time ComputerName Process_Name Initiating_Process_Name 2025-03-19 12:00:00 ABCDE welcome.exe cmd.exe   WHAT I WANT:  I want to feed this into the next search in EventCode=4688 to identify the Process Name and subsequently linking to the Initiating_Process_Name that appear as a result of the above search, i.e. Final outcome I want: _time ComputerName Object_Name Process_Name Initiating_Process_Name 2025-03-19 12:00:00 ABCDE \ABC\hello.exe welcome.exe cmd.exe   The issue is, EventCode=4688 only has Process_Name and Initiating_Process_Name and NO Object_Name, while EventCode=4663 only has Object_Name and Process_Name and NO Initiaitng_Process_Name. The common linkingfactor would be the Process_Name to correlate this two events together.   How can i do this?    ... View more

Hi @gcusello , thanks for your advise. I tried running the search below but it takes quite a long time to show results. Furthermore the query does not display Object_Name as needed ... View more

at the moment, the servers are monitored on splunk, but only win event log:security logs are being piped. I want to increase the monitoring capability to include sysmon and powershell logging, but, i do not want sysmon logs from ALL servers to be indexed and searchable, unless a security event warrants a particular server to have its sysmon indexed.    i.e.  1. all severs have sysmon enabled  2. splunk's security analytics and detection queries runs in the background to monitor the sysmon, if there are any hits, it creates an alert on splunk and the alert log is indexed. 3. alert is sent to a case management system 4. at the request of the security analyst, he can request to view the sysmon of that particular server and that server' sysmon will be indexed on splunk for the past 5 days.  5. analyst will not be able to view sysmon on splunk for the rest of the servers that are not indexed as it is unrelated to the security event. he can only index the sysmon of a particular server IF he triggers that action from the case management system ... View more

Reason for the above is that i have hundreds of servers and if every server has its sysmon log indexed, it will take up a lot of bandwidth, storage space and cost. Hence i am looking to find a possible solution where splunk security detection analytics can run across all servers and triggers an alert for any positive hits, and only at the request of the security analyst, then the sysmon of a particular endpoint of interest will be indexed for the past 5 days for example.  ... View more

Regarding the 0 results, this is my current query: index= useractivitylogs [search index=wineventlog EventCode=4725 earliest=-1h latest=now | eval timestamp=strftime(_time, "%Y-%m-%dT%H:%M"%S") | stats count as count by username | where count=1 fields username ]  Without inputting any table or running any stats on it, it shows up as 0. Even if i were to change my index to the same as the subsearch index, it is still 0 results.  Currently, the subsearch results will list a column of many different usernames. I am trying to troubleshoot as to why running the subsearch results in 0. Will appreciate your help. Thank you ... View more

i tried this but it appears that there are 0 results. Also another thing i noticed is when i used the time modifiers, i.e. (earliest=-1h latest=now), it is relative to the time now, instead of relative to the datetime range i chose at the side bar. Is there a way to change the time modifiers to be relative to the datetime selected at the sidebar?   Thank you ... View more

Thank you, i will try this ... View more

Thanks for the reply. I wanted to have the timestamp of the occurrence as well. I went to do more research and apparently I can add this: | stats count as count, earliest(_time) by username | where count=1   ... View more