Title
#fleet
a

Artem

05/13/2022, 6:07 AM
Is it possible to receive data from Osquery via Fleet without direct binding to hosts? For example, in the form of statistics. I would like to get a list of usernames with the number of each on the servers. For example:
username, count
root, 10
test, 5
mysql 3
redis 1
Lucas Rodriguez

Lucas Rodriguez

05/13/2022, 2:35 PM
Hi @Artem! Two questions:1. What do you mean by "direct binding to hosts". 2. Re your example: are looking into aggregating results from live queries returned by hosts?
a

Artem

05/13/2022, 2:37 PM
@Lucas Rodriguez I mean that currently all osquery results via FleetDM always related to specific hosts. I can not get aggregated results globally.
2:38 PM
@Lucas Rodriguez there was the old issue https://github.com/kolide/fleet/issues/2064 about it in Kolide github repo
Lucas Rodriguez

Lucas Rodriguez

05/13/2022, 2:42 PM
Currently, such aggregation is not possible. However we happen to be working on something similar: #5655 (basically allows
fleetctl query
to aggregate results from hosts by using
sqlite
on memory). Is this something that would help your use case?
a

Artem

05/13/2022, 2:48 PM
@Lucas Rodriguez thank you for answer!