I think I figured it out. I was using the .zip file downloaded from the clone/download button in github and trying to work with that. If I clone osquery with git, I guess that has some other files in it and everything is just working as intended? Not sure what is different between the output of the two retrieval methods.