ehrhardt03/22/2021, 7:03 PM
I don't see a uid or shared data field between the carves table and the users table. What can be done to address this message?
The carves table returns data based on the current user by default, consider JOINing against the users table
which was an error. It was fixed in 4.5.1. That message you see can be safely ignored. So to be clear, for all versions of osquery you do NOT need to join
. And in versions <4.5.1 we incorrectly display that warning.
ehrhardt03/22/2021, 9:59 PM