Obligatory apology for the self-promotion, but felt like folks might benefit from this: https://blog.kolide.com/why-you-cant-trust-your-nulls-in-osquery-36a590d4cebf I wrote a blog-post talking about the differences and some of the obstacles surrounding the handling of NULLs vs. empty strings in osquery output and detailing some of the strategies you might want to use when crafting your SQL.