Vlad Previn
01/18/2023, 5:03 AMAs a workaround, Fleet's manual labels provide a way to create groups of hosts without a query. These manual labels can then be used as targets for queries or query packs.
SELECT * FROM system_info where computer_name IN ('A','B');
Kathy Satterlee
01/18/2023, 3:29 PMSELECT 1
just to keep things streamlined.
If using fleetctl
rather than the API endpoint is an option, creating a manual label would be a bit more efficient:
https://fleetdm.com/docs/using-fleet/configuration-files#labelsVlad Previn
02/03/2023, 7:27 AMapiVersion: v1
kind: label
spec:
name: slack_not_running
query: >
SELECT * FROM system_info
WHERE NOT EXISTS (
SELECT *
FROM processes
WHERE name LIKE "%Slack%"
);
does it add a new label (or update it if exists) , or remove all labels and add this one (replace all label type attrobs)Kathy Satterlee
02/03/2023, 7:15 PM