https://github.com/osquery/osquery logo
Title
w

wkleinhenz

05/19/2020, 3:53 PM
is there a good way to exclude a label from a query like if i have a label for Windows Servers but want exclude a label with only DCs
z

zwass

05/19/2020, 4:03 PM
That kind of operation is not supported. You could make a new label with a query that would do the exclusions and then target that.
w

wkleinhenz

05/19/2020, 4:06 PM
ok im new to queries can i do one query then not another like
select codename from os_version where codename like "%server%" AND select hostname from system_info where hostname NOT like "%dc%"
z

zwass

05/19/2020, 4:17 PM
You probably want something like `SELECT 1 FROM os_version JOIN system_info WHERE codename LIKE "%server%" AND hostname NOT LIKE "%dc%". Try it out via live query to see if returns the hosts you expect.
w

wkleinhenz

05/19/2020, 4:18 PM
ok cool ill give it a shot