i want to propose a feature, but im curious if others are having this problem — Context: We want to ask the question “what version(s) of package $x (lets say glibc) are deployed across the fleet from the last 24h?” Method of solving: set up a snapshot query of

select name, version, arch from rpm_packages;

Ensuing problem: All of the results from the snapshot are in a single event, which means that the JSON has to be broken apart later in splunk. At scale, this post processing of the events just isn’t feasible Potential solution: Instead of dumping all rows into a single event, make the snapshot (optionally?) dump one row per event. That would allow us to say something like:

index=osquery name=rpm_package_snapshot <package name>

and then work from there, rather than having to stitch together all the columns, and then break the rows apart into separate events