Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About spohara79
spohara79
Explorer
Member since:
11-08-2017
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-08-2017 |
Activity Feed
- Got Karma for Re: How can I search for events that match two subsearches?. 06-05-2020 12:49 AM
- Posted Re: Related Fields on Splunk Search. 07-19-2018 02:49 PM
- Posted Re: Related Fields on Splunk Search. 07-19-2018 02:43 PM
- Posted Related Fields on Splunk Search. 07-18-2018 08:33 AM
- Tagged Related Fields on Splunk Search. 07-18-2018 08:33 AM
- Posted Re: How can I search for events that match two subsearches? on Splunk Search. 11-09-2017 07:00 AM
- Posted Re: How can I search for events that match two subsearches? on Splunk Search. 11-08-2017 11:09 AM
- Posted How can I search for events that match two subsearches? on Splunk Search. 11-08-2017 09:03 AM
- Tagged How can I search for events that match two subsearches? on Splunk Search. 11-08-2017 09:03 AM
- Tagged How can I search for events that match two subsearches? on Splunk Search. 11-08-2017 09:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
07-19-2018
02:49 PM
I did give some example events and which matches, but to clarify.. out of the above, only one event matches (the even with file_name cmd.exe)
As a joined search I use the following:
file_name=java.exe | join max=0 process_id [search file_name=cmd.exe | eval process_id=parent_process_id]
it just seems to take too long as a join.
... View more
07-19-2018
02:43 PM
I don't get the expected result. It matches where all processes have a specific parent. A single process can have multiple children. I'm looking for a specific child process name.
... View more
07-18-2018
08:33 AM
I have the following events:
{
"file_name": "java.exe",
"process_id": "0fb9dcff-c345-4d76-ae53-af46cd34524a",
"command_line": "something",
"parent_process_id": "c3df993f-7802-430a-9ef5-e018910aed4b"
},
{
"file_name": "other.exe",
"process_id": "1451fd51-bbce-4c27-999a-ee514e09529f",
"command_line": "some^thing",
"parent_process_id": "0fb9dcff-c345-4d76-ae53-af46cd34524a"
},
{
"file_name": "cmd.exe",
"process_id": "23a192cf-5f2d-4f42-a753-595b702a280b",
"command_line": "some^thing",
"parent_process_id": "0fb9dcff-c345-4d76-ae53-af46cd34524a"
},
{
"file_name": "blah.exe",
"process_id": "16ffed00-1175-4554-b4a3-0ab45e8d691f",
"command_line": "",
"parent_process_id": "39a6cb9d-4dd7-4c44-9ffd-d8ee9561a1a3"
}
I'm trying to pull the events without a subsearch, where I'm looking for a process that has file_name=cmd.exe and a parent process with the file_name=java.exe; In the above events, you see java.exe has two child process (other.exe and cmd.exe) and then a completely unrelated process called 'blah.exe'. I'd like to just return cmd.exe (but only if the parent_process_id matches the process_id of another event with a file_name=java.exe)
... View more
- Tags:
- splunk-enterprise
11-09-2017
07:00 AM
1 Karma
Thanks, this works as expected! Can you respond or update the initial post and I'll accept it, I can't accept it as a comment?
... View more
11-08-2017
11:09 AM
{
"part_id": 9999,
"part_name": "main",
....
}
{
"ref_part_id": 9999,
"part_name": "docker",
"manufacturer": "baz",
...
}
{
"ref_part_id": 9999,
"part_name": "docker",
"manufacturer": "fooz",
...
}
{
"part_id": 1234,
"part_name": "main",
....
}
{
"ref_part_id": 1234,
"part_name": "docker",
"manufacturer": "bar",
...
}
{
"ref_part_id": 1234,
"part_name": "docker",
"manufacturer": "foo",
...
}
{
"part_id": 5678,
"part_name": "main",
....
}
{
"ref_part_id": 5678,
"part_name": "docker",
"manufacturer": "foo",
...
}
{
"ref_part_id": 5678,
"part_name": "docker",
"manufacturer": "bar",
...
}
Given the above, I'd want the return result to be two items:
{
"part_id": 1234,
"part_name": "main",
....
}
{
"part_id": 5678,
"part_name": "main",
....
}
... View more
11-08-2017
09:03 AM
I'm trying to pull back events that have a specific field value, but should only return events that match that field value if it has related events (two criteria of subsearches match).
E.g., I have a part, I only want to return that part if it has two subparts
{
"part_id": 1234,
"part_name": "main",
....
}
{
"ref_part_id": 1234,
"part_name": "docker",
"manufacturer": "bar",
...
}
{
"ref_part_id": 1234,
"part_name": "docker",
"manufacturer": "foo",
...
}
{
"part_id": 5678,
"part_name": "main",
....
}
{
"ref_part_id": 5678,
"part_name": "docker",
"manufacturer": "foo",
...
}
{
"ref_part_id": 5678,
"part_name": "docker",
"manufacturer": "bar",
...
}
I only want to return events where the field 'part_name' is 'main', but I need those events only where the belong to the main part which has a specific ID, the part_name is 'docker' and it has both 'docker' parts from two manufactures ('foo' and 'bar') (it can have other parts and manufacturers, but HAS to at least have those two)
```part_name=main | join max=0 part_id [search manufacturer=bar part_name=docker| rename ref_part_id AS part_id] | join max=0 part_id [search manufacturer=foo part_name=docker | rename ref_part_id as part_id]```
I'm getting unexpected results
... View more
