https://github.com/osquery/osquery logo
Title
s

Stefano Bonicatti

12/13/2019, 10:32 PM
Intruding again: Ok so this is the part I personally still miss. Because for me it doesn't convey how many times your table code will be called depending on the combination of options you give. For instance I look at
required
and I see that the goal is to have that column always passed to the table, so I add it to my "path" column (supposing I have a table that operates on paths), and I expect that my table code is called anytime
path
changes. But is that true? So I might be remembering wrong but if I have a query that has
WHERE path IN ("1", "2", "3")
I will receive only one call and one of those values no?
t

theopolis

12/14/2019, 12:20 AM
Because for me it doesn't convey how many times your table code will be called depending on the combination of options you give.
Correct. I do not think we can convey this.