So I had an issue with a query because the underlying code had a bug. I've fixed that and rolled it out across my fleet (minus a last few stragglers) but I still see syntax errors in fleet for the same queries. Could it be that I need to configure something to "see" the custom tables I'm creating in Fleet, or is it because I have a few stragglers with the broken table, or something else entirely? I can now run the query locally against osqueryd with no error, so not sure why Fleet would complain of a syntax error now.
04/27/2022, 3:05 AM
If you actually run the query in Fleet do you get a syntax error? It might just be that it doesn't recognize your extension table name.
04/27/2022, 5:36 AM
You mean like via distributed query? Yeah that runs okay now, minus the few that haven't gotten the change successfully yet. It does use custom tables so Fleet not knowing about them would make sense. Is there a way to get it to identify them in the UI to eliminate the error?
Is this just a UI thing we can expect if we have custom tables in a query or is there a way to fix it?
05/03/2022, 9:38 PM
Yes, we don't yet have a way to allow you to define your own custom tables for use in the query syntax checking. Please feel free to file an issue.