The pstree command requires two arguments, child and parent. The command is intended for sysmon EventCode=1 events but can be used for anything. The command returns a row for each root value with a multivalue field, "tree", containing the root value and all childern values.
Note: Fields passed as arguments to the pstree command must be referenced before calling pstree. The simplest way to ensure this is to include "| fields *" prior to piping to pstree. Thanks to github user spitzd for discovering.
index=sysmon EventCode=1 host=victim_machine | fields * | pstree child=Image parent=ParentImage | table tree
index=sysmon EventCode=1 host=victim_machine | rex field=ParentImage "\x5c(?<ParentName>[^\x5c]+)$" | rex field=Image "\x5c(?<ProcessName>[^\x5c]+)$" | eval parent = ParentName." (".ParentProcessId.")" | eval child = ProcessName." (".ProcessId.")" | eval detail=strftime(_time,"%Y-%m-%d %H:%M:%S")." ".CommandLine | pstree child=child parent=parent detail=detail spaces=50 | table tree
index=sysmon EventCode=1 host=victim_machine | fields * | pstree child=Image parent=ParentImage | search tree=*<process name>* | table tree
To report problems, please go to issues section on Github
Built by Donald Murchison
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.