I know it's kind of dumb to point out the issue that is highlighted in the syntax, but https://github.com/facebook/osquery/issues/3414