@kidcartouche: I am assuming you are running

osqueryi

(where events are disabled by default). If you want to play around with event-based tables in osqueryi, you'll need to use

osqueryi --disable_events=false

.