Yeah I’ve been piping to jq, I guess I’m missing the point of osqueryi then. I was thinking of using it to gather pieces of information from machines on a recurring basis, so every fifteen minutes grab disk space, that sort of thing.

osqueryi is for 1) proofing queries and 2) can be used for live triage on a system