https://github.com/osquery/osquery logo
Title
a

allister

10/03/2022, 6:00 AM
ok how do I make the magical mdfind table do my bidding, this is the complement from the CLI that works:
mdfind -name pip- info
but no matter what iteration I try (kMDItemFSName, kMDItemDisplayName, glob's, spaces) I can't seem to get any results from mdfind.query, using @fritz's file table join syntax, e.g.:
> SELECT f.path FROM file AS f JOIN mdfind ON mdfind.path = f.path AND mdfind.query = "kMDItemFSName == 'pip-*info'";
> SELECT f.path FROM file AS f JOIN mdfind ON mdfind.path = f.path AND mdfind.query = "kMDItemDisplayName == 'pip- info'";