Thanks for the question. The answer is to match the whitelist to how your “process” field is extracted in Splunk. According to the documentation (here), the process field will be just the name of the executable. So we recommend using only the name of the process in the whitelist_process.csv under the “process” column. For example: the whitelist_process.csv would look something like: process,whitelist splunk-regmon.exe, whitelist winword.exe, whitelist excel.exe, whitelist outlook.exe, whitelist powerpnt.exe, whitelist visio.exe, whitelist The following steps may be helpful in achieving your goal: Considering your datamodel: All_Application_State.Processes is populated correctly and accelerated. 1) Get a count of process’ from your logs and curate this list. | tstats `summariesonly` count from datamodel=Application_State.All_Application_State where nodename=All_Application_State.Processes by All_Application_State.process |`drop_dm_object_name("All_Application_State")`| `drop_dm_object_name("Processes")` | sort -count 2) Automatically add process to the whitelist_process.csv by appending the following to above search: <bit9 search to get process names> | eval whitelist="whitelist" | table process whitelist | outputlookup whitelist_process append=true 3) Make sure this list if thoroughly curated by checking the values using: |inputlookup whitelist_process ... View more