Hi guys, When I tried to run ```EXISTS(SELECT size...
# general
e
Hi guys, When I tried to run
Copy code
EXISTS(SELECT size from file where path = '/tmp/et.txt')
I get this error : "Error: near "EXISTS": syntax error" Maybe do you have a different solution instead of "EXISTS" ?
s
Osquery uses SQLite as the underlying engine. So whatever works there will work. What is exists supposed to do?
e
I want to know if file EXISTS
Likewise you could write:
Copy code
SELECT 'true' AS is_present FROM file WHERE path = '/tmp/et.txt'
If you wanted to return a boolean row both when the file was present/missing you could employ
CASE
logic as follows:
Copy code
SELECT CASE WHEN (SELECT 1 FROM file WHERE path = '/tmp/et.txt') THEN 'true' ELSE 'false' END AS file_present
2
e
Great idea ! Thanks again