https://github.com/osquery/osquery logo
Join Slack
Title
#general
m

monkykap

02/23/2018, 3:24 AM
split {
      field => "[snapshot]"
    }
pirxthepilot

pirxthepilot

02/23/2018, 7:05 PM
ooh interesting, been wondering about this too. does this result in the snapshot being split across 3 events (going by your example)?
View count: 2
Join thread in Slack