Hey I d like to scan my fleet to see if `some filename` is m

Question

Hey I d like to scan my fleet to see if `some filename` is missing on any host for whatever reason `file` table gives me a nice result for machines that have my `some filename` in place but how to invert such query

toka · Answer

so in other words im interested in hostnames that are not listed in the results when I do `SELECT path FROM file WHERE path= some file `

allister · Answer

maybe something like `osquery gt select type from file where path = etc hosts and type = regular `

toka · Answer

I think when file is not existent each host is excluded from results anyway

zwass · Answer

`SELECT 1 AS missing WHERE SELECT path FROM file WHERE path= some file IS NULL `

toka · Answer

I was messing with making JOINS to `system info` < zwass> this is excellent thanks

zwass · Answer

You re welcome Always love a good < C0F2H1A1L|sql> problem slightly smiling face