(type:SYSCALL SYSCALL:sysinfo) (-exe:\/bin\/splunkd)