Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I'm attempting to query my `puppet_state` table, but when looking at my machine there is no data, though I do see I have a `/opt/puppetlabs/puppet/cache/state/last_run_report.yaml` file.  I'm not seeing any local errors in the orbit logs, is there something else I should be looking for?

errors should get returned in the Fleet console, but you might get more information from running the same query in the interactive terminal:
```sudo /opt/orbit/bin/orbit/orbit shell```

not much too the extension, it's just parsing yaml
<https://github.com/macadmins/osquery-extension/blob/main/tables/puppet/yaml.go#L21>

hmm, this is all I'm seeing in that query.
```osquery&gt; SELECT * from puppet_state;
osquery&gt;```
I guess there isn't a whole lot of data in that state file anyway, but just interesting that I'm not seeing any errors or any data, though there is definitely data in the file.

do you know of a sample yaml report I can use to test? (without having to fire up puppet)

my guess is the bug has something to do with `strings.Replace(yamlString, "\r", "\n", -1)`

sample_puppet_report.yaml

I put the sample report on my (macos) device (`/opt/puppetlabs/puppet/cache/state/last_run_report.yaml`) and i'm getting a result:
```osquery&gt; select * from puppet_info;
cached_catalog_status = not_used
         catalog_uuid = 613a2dff-c90e-4198-a09b-65aebf9d983a
              code_id =
configuration_version = puppet-xxxxx-531a4c76118
    corrective_change = false
          environment = production
                 host = <http://example.node.com|example.node.com>
                 kind =
          master_used =
                 noop = false
         noop_pending = false
       puppet_version = 8.6.0
        report_format = 12
               status = unchanged
                 time = 2024-10-17T22:04:39.128389500-07:00
transaction_completed = true
     transaction_uuid = true```

ah, i'm getting the same empty result here:
```osquery> select * from puppet_state;
osquery>```
it's because `resource_statuses` is empty:
```resource_statuses: {}```

hmm is there a flag to have puppet fill that?   I dont see any errors or anything in the run

oh maybe <https://www.puppet.com/docs/puppet/8/configuration.html#exclude-unchanged-resources|exclude_unchanged_resources> needs to be `false` (defaults to `true`)?

ah, I can confirm when I query a host with changed assets that I do see some data, so that's definitely what is going on.  I'll see if we can update our config.

sounds like there is an impact to storage (is that why the default is to exclude?) so would need to check that before toggling