https://github.com/osquery/osquery logo
Title
p

Prakhar

07/11/2018, 6:13 AM
Hey, I'm testing following query with osqueryd conf : "query" : "SELECT *,REPLACE(path, (SELECT REGEX_SPLIT(path, \"[\.\w-]+$\", 0)), '' ) AS name from process_events;"
f

fmanco

07/11/2018, 10:03 AM
From just eyeballing this I think you need to escape the backslashes, i.e. from
\.
to
\\.
and
\w
to
\\w
.
p

Prakhar

07/11/2018, 10:30 AM
Thanks, I was able to make it work by escaping \w which I was not doing initially