https://github.com/osquery/osquery logo
Title
j

jimmy

05/24/2022, 1:40 PM
im running a script with fleet rest api and when i run the query i get an error 'new query: Query 0 already exists in datastore' do you know what this error mean?
t

Tomas Touceda

05/24/2022, 1:49 PM
hi there, I believe that means that you are trying to create a query that collides in name with another one that's already there
j

jimmy

05/24/2022, 2:07 PM
but at my script i run sql query syntax, what do you mean thats the query already there
t

Tomas Touceda

05/24/2022, 2:21 PM
could you share your script so that I can see better what might be going on?
j

jimmy

05/24/2022, 6:53 PM
i will explain you my main code at some steps: i have multiply queries that i have to run 1.
GET /api/v1/fleet/spec/queries/{name}
- i run that to check if query exists 2.
POST /api/v1/fleet/queries/run_by_names
- than i run that to run the query 3. than i call a thread that using websocket to get the result and meanwhile i going over a loop on 1 and 2 and when i get to second query i get that error
at number 2 i get error
t

Tomas Touceda

05/24/2022, 7:03 PM
if you are using the query name from point 1 as the query parameter in point 2, that's the issue
you either need to supply a query id or a query string, eg: select * from some_table
and then the targets is what you can reference by name: hosts, labels
j

jimmy

05/24/2022, 7:22 PM
at 1. im using query name at 2. im using query sql string at 3. im using query from 2
what should i change?
t

Tomas Touceda

05/24/2022, 7:24 PM
ah, I see. It's hard to say without looking at the code. You can try instead of using the query string, using the query id in run_by_names so it doesn't try to create the query again
j

jimmy

05/24/2022, 7:52 PM
but how can i get the query id
t

Tomas Touceda

05/24/2022, 7:55 PM
you should get it in the result of 1
j

jimmy

05/24/2022, 7:58 PM
{
  "specs": {
    "name": "query1",
    "description": "query",
    "query": "SELECT * FROM osquery_info"
  }
}
that is what 1 return according to your docs
t

Tomas Touceda

05/24/2022, 8:08 PM
could you check that queries exist by listing queries and checking in the list? https://fleetdm.com/docs/using-fleet/rest-api#list-queries
it’s just an alternative. What version of fleet are you using? I don’t see that error message in the current version
j

jimmy

05/24/2022, 8:48 PM
im using fleet 3.5.1
"could you check that queries exist by listing queries and checking in the list?" I don't think that is a good idea because I have many queries
z

zwass

05/24/2022, 9:06 PM
Hey Jimmy, Fleet 3.x is no longer supported by Fleet (see https://fleetdm.com/handbook/community#version-support). A lot has changed with Fleet since then, so we try to focus our debugging efforts on the current major version (4.x).
j

jimmy

05/25/2022, 7:49 AM
now that i did time.sleep(2) after 3 it works