Using lookup table within tstats

[losttranslation]

Hi All,

I am attempting to use lookup table "is_windows_system_file"  for the following SPL where the Processes.process_name needs to match the filename from the lookup table. Once these results are obtained I then want to attempt to see processes that are not running from C:\Windows\System32 or C:\Windows\SysWOW64 

| tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name=* by Processes.aid Processes.dest Processes.process_name Processes.process _time

[richgalloway]

As I understand it, you want the tstats command to look only for process names in the lookup file.  You can do that with a subsearch

| tstats `summariesonly` count from datamodel=Endpoint.Processes where [|inputlookup is_windows_system_file" 
  | fields filename 
  | rename filename as "Processes.process_name" 
  | format] by Processes.aid Processes.dest Processes.process_name Processes.process _time