Any recommendations on checking the performance of a query prior to making it a label in Fleet? I want to check if a device is one of ~50 hardware models.

Hey @Phillip Boushy! The easiest way to do that would be to save the query as a scheduled query and let it go through a few runs to gather data. That being said, I don't anticipate a query that's checking against a list of hardware models to be particularly hefty. I'm assuming you're doing something like:SELECT 1 FROM system_info WHERE hardware_model in ( first, second, third, etc)

Yeah, that's the plan. I was hoping there was a way to check it locally in a VM or something prior to adding it into fleet at all.

If you want to, you can run your query with osquery directly first-- see execution time, use

*EXPLAIN* QUERY *PLAN*

and monitor your VM

EXPLAIN QUERY PLAN

? is that you put the query in the middle of EXPLAIN PLAN

@Phillip Boushy sorry for the late reply, so you can use

EXPLAIN QUERY PLAN

before your SQLite query to see how it will be executed. This is useful for understanding performance and potential optimizations since it should output a step-by-step description of how SQLite (and thus osquery) will process your query, including what indexes it will use and the join order.

EXPLAIN QUERY PLAN
SELECT ...