James Pickett
05/03/2023, 10:55 PM.table
file and rebuilt, but it's still acting like it requires the column. Wondering if there is another cmake command or something I need to use. Anyone got any ideas? here is my .table file:
table_name("windows_search")
description("Run searches against the windows system index database.")
schema([
Column("entity", TEXT, "index of entity"),
Column("attribute", TEXT, "attribute"),
Column("value", TEXT, "value"),
Column("max_results", INTEGER, "maximum number of results returned by windows api"),
Column("sort", TEXT, "sort for windows api"),
Column("columns", TEXT, "additional columns to include"),
Column("query", TEXT, "windows search query"),
])
implementation("system/windows/windows_search@genWindowsSearch")
build cmd:
cmake --build . --config RelWithDebInfo --target codegen_native_tables --target codegen_foreign_tables
msg after building:
PS C:\Users\james\repos\james-osquery\build> .\osquery\RelWithDebInfo\osqueryi.exe
Using a [1mvirtual database[0m. Need help, type '.help'
osquery> select * from windows_search;
W0503 15:52:55.837489 15656 virtual_table.cpp:975] Table windows_search was queried without a required column in the WHERE clause
W0503 15:52:55.839401 15656 virtual_table.cpp:986] Please see the table documentation: <https://osquery.io/schema/#windows_search>
Error: constraint failed
seph