Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi all,
Running into a `constraint failed` error when querying the `windows_eventlog` table from fleet. After some troubleshooting I found that  `channel` is a required constraint in the WHERE clause, which I have added but still get the same `constraint failed` error. is there another required constraint when querying `windows_eventlog` ?  Any help is greatly appreciated!

Hi <@U02R5JRQ3GF> ! Can you share the query in question?

```SELECT datetime, computer_name, json_extract(windows_eventlog.data,'$.EventData.ParentProcessName') as 'Parent' from windows_eventlog where eventid = '4688' and channel = 'Security'
and json_extract(windows_eventlog.data,'$.EventData.ParentProcessName') like "winword.exe"
and json_extract(windows_eventlog.data,'$.EventData.NewProcessName') = "C:\Windows\System32\wbem\WMIC.exe"
or json_extract(windows_eventlog.data,'$.EventData.NewProcessName') like "excel.exe"
or json_extract(windows_eventlog.data,'$.EventData.NewProcessName') like "outlook.exe";```

Try ‘source’ rather than ‘channel’. 

I may have checked the wrong table :) one sec. 

Try removing the quotes around `eventid`. It could be that it isn't getting parsed properly as an integer. 

Does a simpler query without the json extraction work?

```SELECT datetime, computer_name from windows_eventlog where eventid = 4688 and channel = 'Security'```

yes! just tried running this query
```SELECT datetime, computer_name, json_extract(windows_eventlog.data,'$.EventData.ParentProcessName') as 'Parent' from windows_eventlog where eventid = 4688 and channel = 'Security';```
and was able to get results

Brilliant! You can go from there to start layering the additional clauses on and see what happens!

<@U02R5JRQ3GF> Did you get this sorted? I'd love to know what the culprit was.

yes! error came down to syntax.  using `or`  resets the constraints set before so in the end, i had it working with:
```SELECT datetime, computer_name, json_extract(windows_eventlog.data,'$.EventData.ParentProcessName') as 'Parent' from windows_eventlog where eventid = '4688' and channel = 'Security'
and json_extract(windows_eventlog.data,'$.EventData.ParentProcessName') like "winword.exe"
and (json_extract(windows_eventlog.data,'$.EventData.NewProcessName') = "C:\Windows\System32\wbem\WMIC.exe"
or json_extract(windows_eventlog.data,'$.EventData.NewProcessName') like "excel.exe"
or json_extract(windows_eventlog.data,'$.EventData.NewProcessName') like "outlook.exe");```
the parenthesis ensures that it keeps the previous constraints