Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Powered by
Title
t
Tor Houghton
01/24/2022, 12:01 PM
Is there a way to convert epoch directly in a query? (I was hoping I could do select from_unixtime(time), but this appears not to work - no such function?)
f
fritz
01/24/2022, 2:14 PM
@Tor Houghton
, you can, here is an article I wrote on various epoch conversions:
https://blog.kolide.com/8-sql-snippets-to-make-you-an-osquery-datetime-expert-a7e418087915#f14e
❤️ 1
t
Tor Houghton
01/24/2022, 2:39 PM
Super! Now I can do SELECT uid,datetime(time,'unixepoch'),path,cmdline FROM bpf_process_events ORDER BY time DESC LIMIT 100;
👍 1
3 Views
#fleet
Join Slack