# Elastic Learning Portal - Getting started: KQL and Lucene

**URL:** <https://discuss.elastic.co/t/elastic-learning-portal-getting-started-kql-and-lucene/391291>\
**Category:** Elastic Training\
**Created:** [October 30, 2026, 8:06am UTC](https://discuss.elastic.co/t/elastic-learning-portal-getting-started-kql-and-lucene/391291 "2026-10-30T08:06:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![George01](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@George01](https://discuss.elastic.co/u/George01)\
**Post date:** [October 30, 2026, 8:06am UTC](https://discuss.elastic.co/t/elastic-learning-portal-getting-started-kql-and-lucene/391291/1 "2026-10-30T08:06:01Z")

</div>

The last Lab4 Question can´t be solved because of missing data.  
Bot-iful Timestamp: Spot the Process  
Select `process.name` and `process.args` as columns. Look at the documents with timestamp `Mar 8, 2022 @ 18:29:12.393` (you may have to scroll down in your results list). What is the process name that contains "bot"?  
host.name: "dc01" AND process.name: \*.exe AND process.args: \*

 ![elastic Getting started KL Screenshot 2026-10-30 090414](https://us1.discourse-cdn.com/elastic/original/3X/5/3/53dc07c44d99f611cd6c7d278489adc478413433.png)

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [October 30, 2026, 6:21pm UTC](https://discuss.elastic.co/t/elastic-learning-portal-getting-started-kql-and-lucene/391291/2 "2026-10-30T18:21:30Z")

</div>

The times shown in the kibana UI might not be in the same timezone ... it's a poorly formatted question. Put the time picker back to BLISTER and try again. This question isn't really about that specific time, it's about whether you can find the "suspect" processes with a KQL or Lucene search. We know the bad guys will call their bot processes \<some-bot-or-another.exe".