Hi everyone, does anyone know if there's a way to ...
# sql
k
Hi everyone, does anyone know if there's a way to query a table (e.x. "table-1234") by either a) constructing the table name somehow such as from parameters, something similar to one of the following:
SELECT * FROM "table-"+"1234"
SELECT * FROM CONCAT("table-","1234")
SELECT * FROM BASE64_DECODE("dGFibGUxMjM0")
b) referencing the table without using the table name itself, something like
SELECT * FROM TABLE.ID[4]
SELECT * FROM (SELECT name FROM osquery_registry WHERE registry='table' AND name LIKE "%%-1234")
Thanks!
none of these are supported by SQLite natively so I was hoping there was something specific to osquery that'd work
f
sqlite does support CONCAT() but the syntax is "||"
k
it supports CONCAT but doesn't appear to allow using the output as a table name unfortunately :\
f
to your specific question though, i don't think sql allows you to dynamically construct a table name in the FROM like that
k
dang, that seemed to be the case but I was hoping there might be a way around it. thank you for the help anyways!
if anyone does know a circuitous way for me to do this, hmu 🙏
f
if the value is predictable you could set it as a "variable" in a CTE virtual table possibly
s
I’m not aware of way to do this.
Maybe you can do somewhere where you select from a bunch of tables, and include a column, and then filter on the column… But I’m not sure it’ll really work. Like:
Copy code
WITH _agg AS (
select *, 't1' as _t FROM table1
UNION
select *, 't2' as _t FROM table2
)
select * from _agg where _t = 't1'
But I see a lot of issues with that approach
f
You can not dynamically declare tables using any method that i am aware of. I went deep trying to accomplish this in the past to solve for queries that had platform constraints (eg. call
apps
only if the device is a mac, call
programs
only if the device is windows, etc.)
k
darn, well at least I'm satisfied now that I've exhausted all possible ways to do this. I'll try to figure out a different solution to my problem, thank you!