https://github.com/osquery/osquery logo
Title
e

ehrhardt

03/22/2021, 7:03 PM
Hey all, the carves table gives the message
The carves table returns data based on the current user by default, consider JOINing against the users table
I don't see a uid or shared data field between the carves table and the users table. What can be done to address this message?
t

theopolis

03/22/2021, 8:12 PM
What version of osquery is this?
Ah, I see that this table did have
user_data=True
which was an error. It was fixed in 4.5.1. That message you see can be safely ignored. So to be clear, for all versions of osquery you do NOT need to join
users
. And in versions <4.5.1 we incorrectly display that warning.
e

ehrhardt

03/22/2021, 9:59 PM
thanks