Channels
doorman
zercurity
infrastructure
code-review
queryhub
apple-silicon
carving
goquery
aws
querycon
golang
file-carving
fuzzing
help-proxy
darkbytes
process-auditing
general
windows
random
fleet-dev
tls
fim
zentral
zeek
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
community-feeds
Powered by
#fleet
Title
t
Tor Houghton
01/24/2022, 12:01 PM
Is there a way to convert epoch directly in a query? (I was hoping I could do select from_unixtime(time), but this appears not to work - no such function?)
f
fritz
01/24/2022, 2:14 PM
@Tor Houghton
, you can, here is an article I wrote on various epoch conversions:
https://blog.kolide.com/8-sql-snippets-to-make-you-an-osquery-datetime-expert-a7e418087915#f14e
❤️ 1
t
Tor Houghton
01/24/2022, 2:39 PM
Super! Now I can do SELECT uid,datetime(time,'unixepoch'),path,cmdline FROM bpf_process_events ORDER BY time DESC LIMIT 100;
👍 1
3 Views
Post