Using lookup table within tstats

losttranslation — Mon, 11 Mar 2024 04:45:03 GMT

Hi All,

I am attempting to use lookup table "is_windows_system_file" for the following SPL where the Processes.process_name needs to match the filename from the lookup table. Once these results are obtained I then want to attempt to see processes that are not running from C:\Windows\System32 or C:\Windows\SysWOW64

| tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name=* by Processes.aid Processes.dest Processes.process_name Processes.process _time

Re: Using lookup table within tstats

richgalloway — Mon, 11 Mar 2024 14:43:08 GMT

As I understand it, you want the tstats command to look only for process names in the lookup file. You can do that with a subsearch

| tstats `summariesonly` count from datamodel=Endpoint.Processes where [|inputlookup is_windows_system_file" | fields filename | rename filename as "Processes.process_name" | format] by Processes.aid Processes.dest Processes.process_name Processes.process _time

topic Using lookup table within tstats in Splunk Search

Using lookup table within tstats

Re: Using lookup table within tstats