If you wouldn't mind, could you paste your results here: https://github.com/facebook/osquery/issues/3625 please? Seem it's not working as expected.