Title
#core
packetzero

packetzero

01/24/2019, 3:48 PM
Heads-up if you have queries that have long IN lists: https://github.com/facebook/osquery/issues/5379
defensivedepth

defensivedepth

01/24/2019, 4:40 PM
Great find - IN lists are a really useful.
8p8c

8p8c

01/25/2019, 2:35 AM
I’ve noticed this also, very painfully obvious with rpm_package_files table. However, I think as a workaround following query pattern avoids it:
WITH _name_ AS ( <select statement> ) SELECT ... FROM _name_ JOIN anothertable ON <constraint>
As comments in github show, the problem is not only with IN.