I did give some example events and which matches, but to clarify.. out of the above, only one event matches (the even with file_name cmd.exe) As a joined search I use the following: file_name=java.exe | join max=0 process_id [search file_name=cmd.exe | eval process_id=parent_process_id] it just seems to take too long as a join. ... View more

You got it! Glad I could help. 🙂 ... View more