Hi All,
I am attempting to use lookup table "is_windows_system_file" for the following SPL where the Processes.process_name needs to match the filename from the lookup table. Once these results are obtained I then want to attempt to see processes that are not running from C:\Windows\System32 or C:\Windows\SysWOW64
| tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name=* by Processes.aid Processes.dest Processes.process_name Processes.process _time
As I understand it, you want the tstats command to look only for process names in the lookup file. You can do that with a subsearch
| tstats `summariesonly` count from datamodel=Endpoint.Processes where [|inputlookup is_windows_system_file"
| fields filename
| rename filename as "Processes.process_name"
| format] by Processes.aid Processes.dest Processes.process_name Processes.process _time