< ET> you could try joining on the mounted path ```SELECT ac osquery #general

<@UPZ1KJQ6T> you could try joining on the mounted ...

Hugh (Zercurity)

07/30/2020, 2:11 PM

@ET you could try joining on the mounted path:

Copy code

SELECT action, DATETIME(time, 'unixepoch') AS datetime, vendor, mounts.path FROM disk_events LEFT JOIN mounts ON mounts.device = disk_events.device;