Anuj Kharbanda
07/28/2023, 11:53 AMunified_log
table.
However, the problem is that this table returns data from earliest to latest and in patches of 100, so using "ORDER BY" does not work as expected for the entire data. Even if I try to use a normal query or paginate the response, it still fetches older data first.
Is there a way I can achieve this? (Fetch latest 100 logs from Unified logs)
Thanks !!Brad Girardeau
07/28/2023, 6:24 PMtimestamp > (select unix_time - 1 from time)
)Brad Girardeau
07/28/2023, 8:00 PMmax_rows
can make it load more than 100 rows at a time to sort by. But I've had some trouble getting queries over this table working reliably at scale without hitting resource limits osquery watchdog sets because the log can have really high volume on some machines