Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I'm having some trouble writing a query to create a label. There's a specific process that should be running on everything in my fleet, I want to return and systems that DO NOT have that process running. Any help or direction is appreciated.

```osquery&gt; SELECT 1 WHERE 'osqueryd' NOT IN (SELECT name FROM processes);
osquery&gt; SELECT 1 WHERE 'mysqld' NOT IN (SELECT name FROM processes);
+---+
| 1 |
+---+
| 1 |
+---+```

Does this idea make sense? Return a result when the process is not running, return no result if the process is running.

yeah that makes perfect sense, thanks a ton