fritz
12/04/2019, 8:11 PMosquery> .version
osquery 4.0.1
using SQLite 3.26.0
osquery> select COUNT(*) from mdfind, file USING(path) where query = "kMDItemFSName == '*.sketch'";
+----------+
| COUNT(*) |
+----------+
| 999 |
+----------+
osquery> .version
osquery 4.1.1
using SQLite 3.29.0
osquery> select COUNT(*) from mdfind, file USING(path) where query = "kMDItemFSName == '*.sketch'";
+----------+
| COUNT(*) |
+----------+
| 0 |
+----------+
osquery>