hehe yeah…i mean it would be 100x easier if i could say

index=osquery name=file_events columns.process_name!=puppet