Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

```SELECT datetime(unix_time, 'unixepoch', 'localtime') FROM time;```

Thank you! It's from the SQL documentation? I couldn't understand the syntax

I don't remember where I found that syntax referenced but it is essentially:
```SELECT datetime(myColumn, 'InputTimeFormat', 'OutputTimeModifier') FROM table;```

Cool! OutputTimeFormat could be any time zone?

1. NNN days
2. NNN hours
3. NNN minutes
4. NNN.NNNN seconds
5. NNN months
6. NNN years
7. start of month
8. start of year
9. start of day
10. weekday N
11. unixepoch
12. localtime
13. utc


```datetime(...)	==	strftime('%Y-%m-%d %H:%M:%S', ...)```

For comparisons also remember there is:
```SELECT 'true' AS within_last_30_days WHERE myColumn &lt; datetime('now', '-1 month');```

the `datetime` function is pretty overloaded. that list of modifiers comprises date addition, truncation, and some very limited parsing