Heads-up if you have queries that have long IN lists: https://github.com/facebook/osquery/issues/5379

Great find - IN lists are a really useful.

I’ve noticed this also, very painfully obvious with rpm_package_files table. However, I think as a workaround following query pattern avoids it:

WITH _name_ AS ( <select statement> ) SELECT ... FROM _name_ JOIN anothertable ON <constraint>

As comments in github show, the problem is not only with IN.