https://github.com/osquery/osquery logo
Title
d

David Ratana

04/09/2020, 4:49 PM
Hey all, wondering how does one create a label to break out Windows servers? I've been playing with various string based around the os_version name but can't figure it out. What would be a good sql string?
s

sundsta

04/09/2020, 5:26 PM
select 1 from os_version where platform='windows'
should work
If you need to split servers from desktop os you would want
select 1 from os_version where platform='windows' and instr(name, 'Server') > 0;
d

David Ratana

04/09/2020, 10:17 PM
Thanks, the second one worked out perfect.