``` split field = gt snapshot ``` osquery #general

``` split { field => "[snapshot]" }...

monkykap

02/23/2018, 3:24 AM

Copy code

split {
      field => "[snapshot]"
    }

pirxthepilot

02/23/2018, 7:05 PM

ooh interesting, been wondering about this too. does this result in the snapshot being split across 3 events (going by your example)?

2 Views