Have you looked at https://osquery.readthedocs.io/en/stable/introduction/using-osqueryi/ and the following section on osqueryd?