https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi, quick question - we’re rebuilding our Fleet fr...
# fleet
r
Hi, quick question - we’re rebuilding our Fleet from scratch and migrating hosts over, is there a quick way to export/import the existing queries and query packs?
I thought the tables 
queries
, 
packs
and 
pack_targets
would be sufficient, but the 
queries
table seems to contain way more than the UI showed (possibly a history of queries too)?
t
hi! we don't currently have a standard way to do this, but one way would be to use 
fleetctl get packs --with-queries
and then apply that in the new install
r
ah nice idea
thanks!
👍 1
Hmm, the 
--with-queries
option doesn’t appear to have any affect
It returns the 
name
platform
description
and 
disabled
columns in both cases
t
what version of fleetctl are you running?
oh, also, try adding 
--yaml
r
Copy code
fleetctl - version 4.6.1
  branch:       HEAD
  revision:     2b2e9f9f44d55c06ce8ce1249b0f2166f2ebb3a0
  build date:   2021-11-22
  build user:   runner
  go version:   go1.17.2
👍 1
Ok, will try that
aha yes
that did it
😄
It did look like it was gathering the extra data, because the command took longer to execute when 
--with-queries
was present.
t
yeah, the UX is not ideal, it should've warned you that you probably wanted to add 
--yaml
or 
--json
r
No worries 🙂
Ok, all good, queries and packs “transplanted” from one brain to the other.
Thanks again!
t
great to hear!
r
One oddity of doing this, as hosts are coming back online, we’ve got this weird situation on the “Hosts” tab:
If I invert the sort order I can see normal hostnames in alphabetical order, when we get to the beyond the letter A it’s all blank hostnames “offline”. I assume that will sort itself out though later?
we have Host Expiry Window of 1 day, so should be ok I think, but just wanted to let you know
t
thanks, that is extremely weird, let me know if it sorts itself out otherwise we'll dig deeper
r
👍
FYI @Tomas Touceda it did indeed sort itself out, we’re all good again 🙂
t
great!
3 Views
Open in Slack
PreviousNext
Powered by