osqueryi "select * from windows_events" > my_file.txt"
A Conno06/18/2019, 6:30 PM
is an event based table, meaning osquery has to be running interactively, so either dropping to the shell or running as the daemon, before any data will be generated
A Conno06/18/2019, 6:35 PM
A Conno06/18/2019, 9:56 PM