I'm assuming you're running queries from osqueryd?...
# general
a
I'm assuming you're running queries from osqueryd? That would run as root, and therefore it's using a default. You'd need to wildcard users... there should be an example in the Packs