how are you doing it just like `osqueryi select f

Question

< A Conno> how are you doing it just like `osqueryi select from windows events gt my file txt `

A Conno · Answer

just like that

thor · Answer

Ah ok that wont work because `windows events` is an event based table meaning osquery has to be running interactively so either dropping to the shell or running as the daemon before any data will be generated

thor · Answer

You can read more about event based vs schedule based tables in the read the docs

A Conno · Answer

got it so if I want to get the results outside shell need to use the daemon

thor · Answer

Yeah for this instance you d be better off using the daemon

A Conno · Answer

thanks I was way over complicating things just added a couple basic queries to the config restarted daemon and events started flowing into logs

A Conno · Answer

is there a manual way to flush an events table i ve tried significantly lowering events expiry but I don t think the flags file is being read

thor · Answer

The best you can do is to decrease the query interval to be very close together