The pstree command requires two arguments, child and parent. The command is intended for sysmon EventCode=1 events but can be used for anything. The command returns a row for each root value with a multivalue field, "tree", containing the root value and all childern values.
The pstree command now uses an iterative algorithm to create process tree. The legacy recursive algorithm can be used by specifying method="r".
Note: Fields passed as arguments to the pstree command must be referenced before calling pstree. The simplest way to ensure this is to include "| fields " prior to piping to pstree. Thanks to github user spitzd* for discovering.
index=sysmon EventCode=1 host=victim_machine
| fields *
| pstree child=Image parent=ParentImage
| table tree
index=sysmon EventCode=1 host=victim_machine
| rex field=ParentImage "\x5c(?<ParentName>[^\x5c]+)$"
| rex field=Image "\x5c(?<ProcessName>[^\x5c]+)$"
| eval parent = ParentName." (".ParentProcessId.")"
| eval child = ProcessName." (".ProcessId.")"
| eval detail=strftime(_time,"%Y-%m-%d %H:%M:%S")." ".CommandLine
| pstree child=child parent=parent detail=detail spaces=50
| table tree
index=sysmon EventCode=1 host=victim_machine
| fields *
| pstree child=Image parent=ParentImage
| search tree=*<process name>*
| table tree
index=sysmon EventCode=1 host=victim_machine
| fields *
| pstree child=Image parent=ParentImage method="r"
| table tree
To report problems, please go to issues section on Github
https://github.com/murchisd/splunk_pstree_app/issues
Built by Donald Murchison
PSTree now uses an iterative algorithm instead of recursive. This was implemented to address pstree.py - recursion depth exceeded while calling a python object. Line 85. error that many users were receiving.
Due to limited testing ability of the iterative method, the legacy recursive algorithm is still accessible by specifying method="r" in when calling pstree.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.