The pstree command requires two arguments, child and parent. The command is intended for sysmon EventCode=1 events but can be used for anything. The command returns a row for each root value with a multivalue field, "tree", containing the root value and all childern values.
Note: Fields passed as arguments to the pstree command must be referenced before calling pstree. The simplest way to ensure this is to include "| fields *" prior to piping to pstree. Thanks to github user spitzd for discovering.
index=sysmon EventCode=1 host=victim_machine
| fields *
| pstree child=Image parent=ParentImage
| table treeindex=sysmon EventCode=1 host=victim_machine
| rex field=ParentImage "\x5c(?<ParentName>[^\x5c]+)$"
| rex field=Image "\x5c(?<ProcessName>[^\x5c]+)$"
| eval parent = ParentName." (".ParentProcessId.")"
| eval child = ProcessName." (".ProcessId.")"
| eval detail=strftime(_time,"%Y-%m-%d %H:%M:%S")." ".CommandLine
| pstree child=child parent=parent detail=detail spaces=50
| table treeindex=sysmon EventCode=1 host=victim_machine
| fields *
| pstree child=Image parent=ParentImage
| search tree=*<process name>*
| table treeTo report problems, please go to issues section on Github
https://github.com/murchisd/splunk_pstree_app/issues
Built by Donald Murchison
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.