Hi All, Does anyone know if I can use the Host col...
# macos
g
Hi All, Does anyone know if I can use the Host column as part of a query? Ex: when I run a query like select * from wifi_status I can see the Host column, but if I try to use it in a query I receive an error that Host is not a valid column
s
Hello @Guilherme Monteiro, there's no
host
column in `wifi_status`: https://osquery.io/schema/5.9.1/#wifi_status Are you maybe seeing that from a fleet manager dashboard?
In any case, https://osquery.io/schema/5.9.1/#system_info would for instance contain the
hostname
g
Hey Stefano, I know that wifi_status does not have a host column but when I ran a query the column Host appears. I think it’s an implicit column because appears in all queries even if the table doesn’t have the column host like wifi_status. What I’m trying to do is a join with system_info table to have the devices serial number with wifi_status info
s
Keep in mind that the osquery project deals with just the agent that runs on the various machines, collecting data; what you are showing me there is a web UI from a third party. This Slack hosts channels of some third party fleet managers, so you might want to browse the channels to find the vendor specific ones for this kind of questions.
g
oh ok, I’m sorry about it
s
No, no problem, it's mostly that they are better equipped on answering those questions. Although solving this SQL wise would mean making a single query which queries both, so that the data is retrieved together. But it seems this is more a log/query result processing question.
g
But I cannot execute a query using join with wifi_status and system_info because we don’t have the same column (like a primary key) in both tables
s
What I was intending is that you can do:
Copy code
SELECT w.*, s.hostname, s.hardware_serial FROM wifi_status as w, system_info as s;
But this obviously means changing the query and having all the machines resend the data, so that it's all together (and also, each row present in wifi_status will have those 2 additional columns, so data is duplicated). If you want to instead join data after the fact, when it's in the third party fleet manager, then that's their UI job
g
Worked, now I can see the wifi infos and serial number as well
thx Stefano 🙂