osquery> select * from file where path IS NOT NULL; W0927 150733.662343 15964 virtual_table.cpp:504] Table file was queried without a required column in the WHERE clause W0927 150733.662343 15964 virtual_table.cpp:515] Please see the table documentation: https://osquery.io/docs/#file osquery> select * from file where path like '%'; +---------------+-----------+---------------+-------+-----+-----+------+--------+---------+------------+------------+------------+------------+-------+------------+-----------+ | path | directory | filename | inode | uid | gid | mode | device | size | block_size | atime | mtime | ctime | btime | hard_links | type | +---------------+-----------+---------------+-------+-----+-----+------+--------+---------+------------+------------+------------+------------+-------+------------+-----------+ | api_token.txt | | api_token.txt | 0 | 0 | 0 | 0666 | 2 | 50 | | 1475013947 | 1474911694 | 1474911694 | 0 | | regular | | osquery.flags | | osquery.flags | 0 | 0 | 0 | 0666 | 2 | 723 | | 1475013947 | 1474911694 | 1474911694 | 0 | | regular | | osqueryd\ | osqueryd | . | 0 | 0 | 0 | 0777 | 2 | 0 | | 1475008537 | 1475007039 | 1475007027 | 0 | | directory | | osqueryi.exe | | osqueryi.exe | 0 | 0 | 0 | 0777 | 2 | 8194560 | | 1475008307 | 1474594352 | 1475007037 | 0 | | regular | | packs\ | packs | . | 0 | 0 | 0 | 0777 | 2 | 0 | | 1475008537 | 1474911693 | 1474911693 | 0 | | directory | | yara\ | yara | . | 0 | 0 | 0 | 0777 | 2 | 0 | | 1475008537 | 1474911693 | 1474911693 | 0 | | directory | +---------------+-----------+---------------+-------+-----+-----+------+--------+---------+------------+------------+------------+------------+-------+------------+-----------+ osquery> select * from hash where path LIKE '%'; osquery>