https://github.com/osquery/osquery logo
Title
p

PJ Meyer

06/26/2020, 7:24 PM
hey all, also posted this in #sql, figuring it touches both subjects, but is it possible to run a query without the hostname in the selection (in kolide fleet)? i notice if i try to group distinct chrome_extensions through a list of assets  i'll still receive 1 row per computer, but i'm looking to group all computers and see a count of how many assets have the extensions installed
z

zwass

06/26/2020, 9:25 PM
Fleet retrieves results from individual endpoints, but doesn't do any complex aggregations. You're best off getting the results via
fleetctl
(or exporting) and doing the aggregation with other tools.
p

PJ Meyer

06/26/2020, 9:51 PM
thank you!
t

terracatta

06/26/2020, 10:02 PM
Just thought I’d add our SaaS product does some of this for you with a feature called inventory. Ex: It will list all the unique chrome exts by unique identifier and you can then dive in from there. Check out the free trial if you want to see what I mean