ehrhardt
03/22/2021, 7:03 PMThe carves table returns data based on the current user by default, consider JOINing against the users table
I don't see a uid or shared data field between the carves table and the users table. What can be done to address this message?theopolis
user_data=True
which was an error. It was fixed in 4.5.1. That message you see can be safely ignored.
So to be clear, for all versions of osquery you do NOT need to join users
. And in versions <4.5.1 we incorrectly display that warning.ehrhardt
03/22/2021, 9:59 PM