https://github.com/osquery/osquery logo
Title
e

Esteban

09/22/2020, 2:40 PM
I want to group hosts by osq version but even with a GROUP BY, osquery always returns me one row per host
z

Zach Zeid

09/22/2020, 2:42 PM
This might be better for #sql but posting the query would help
s

seph

09/22/2020, 3:03 PM
What are you querying? osquery returns data for one host. If you’re trying to aggregate, then you need some kind of intermediary storage
e

Esteban

09/22/2020, 3:39 PM
Multiple hosts by Kolide, i want to group by one value and merge rows
s

seph

09/22/2020, 3:40 PM
What Kolide product? And querying how?
I don’t think Fleet (Kolide’s OSS offering) has a data aggregation side. Something like live query is sending the queries out, and returning there. There is no consolidated database of results. You may, however, be interested in our SaaS offering.
z

zwass

09/22/2020, 3:48 PM
With Fleet you can use fleetctl to query from your shell and then use pipes to do something like
fleetctl query | jq (select some part you are interested in) |  sort | uniq
.