search

murchisd / splunk_pstree_app

Custom Splunk search command to reconstruct a pstree from Sysmon process creation events (EventCode 1)
22 stars 4 forks source link

Recursion depth exceeded while calling pstree #5

Closed RaeldZues closed 1 year ago

RaeldZues commented 2 years ago

pstree.py - recursion depth exceeded while calling a python object. Line 85. Assumption that this would be limited in a small scale specific search.

murchisd commented 2 years ago

Hi @RaeldZues, this is a Splunk limitation. Recursion depth cannot exceed 7. I will look in to converting the app to use iterative method instead of recursion.

murchisd commented 2 years ago

Branch pstree_v2 created with an iterative method for this app. You can install the tgz file on an instance of Splunk and run the search using pstree_v2 instead of pstree. The recursive method can still be called with pstree for comparison.

murchisd commented 2 years ago

@RaeldZues let me know if the iterative method of PSTree mentioned above solves your issue

murchisd commented 1 year ago

Pstree 2.0 has been vetted and approved by Splunk for On-Prem and Cloud deployments. By default, it uses an iterative method and should not cause recursion error.