https://github.com/osquery/osquery logo
Title
j

Jason NG

07/02/2021, 1:35 AM
sorry for the amateur question. But does anyone know how to join os_version table to rpm_packages table? i cant seem to find a common identifier to perform the join. Thanks!
t

theopolis

07/02/2021, 2:11 AM
You can compose these tables with
select * from rpm_packages, os_version
😮 1
s

seph

07/02/2021, 2:31 AM
What does joining them mean? If there’s no common identifier, than the join is somewhat odd?
j

Jason NG

07/02/2021, 2:34 AM
to create a single table. But thanks! it works!
s

seph

07/02/2021, 2:35 AM
What does ā€œsingle tableā€ mean? Sort of where I’m going here, is while you can stitch arbitrary data together, it may lose semantic meaning.
j

Jason NG

07/02/2021, 2:41 AM
ideally i want to stitch os_version, rpm_packages and system_info together. so that for each application found in rpm_packages i know the hostname as well as the os that it is running on
s

seph

07/02/2021, 2:55 AM
Depending on exactly what you’re doing, there may be other routes. Sometimes people use decorators for this, depends a lot on what the resultant data storage is like.