https://github.com/osquery/osquery logo
Title
v

Vlad Previn

02/21/2023, 8:39 AM
👋 quick question - can you please help with a composite query that shows the following
os info
system info
osq version (agent) info
had a quick look at the os_version, system_info and osquery_info and not quite clear how we’d join them (by udid or serial ?) in particular for the osinfo one
l

Lucas Rodriguez

02/21/2023, 10:28 AM
Hi @Vlad Previn Seems you can do this the following way:
SELECT os.*, si.*, oi.* FROM os_version os, system_info si, osquery_info oi;
v

Vlad Previn

02/21/2023, 11:14 AM
ty that works 🙂 . tho i have no idea how it knows that i want to join it by uuid (?)
l

Lucas Rodriguez

02/21/2023, 11:22 AM
If the join-operator is "CROSS JOIN", "INNER JOIN", "JOIN" or a comma (",") and there is no ON or USING clause, then the result of the join is simply the cartesian product of the left and right-hand datasets. If join-operator does have ON or USING clauses, those are handled according to the following bullet points:
Given that these tables all have one row, then the result is all columns in one row.
Let me know if it makes sense 🙂
v

Vlad Previn

02/22/2023, 3:18 AM
oh right. so it basically works ….because it’s one row result in all 3 tables 🤔 and there’s no implied join. i see thank you for explaining