https://github.com/osquery/osquery logo
#macos
Title
f

fritz

10/03/2022, 1:12 PM
The "simple syntax" no longer appears to be supported by the osquery
mdfind
table but works still in victor's earlier launcher implementation `kolide_spotlight`:
Copy code
osquery> SELECT COUNT(*) FROM kolide_spotlight WHERE query = "-name pip- info";
+----------+
| COUNT(*) |
+----------+
| 10       |
+----------+
2 Views