I can't seem to find a way to do it in osquery and thinking I need to do this via log parser