👋 quick question - can you please help with a composite query that shows the following

os info
system info
osq version (agent) info

had a quick look at the os_version, system_info and osquery_info and not quite clear how we’d join them (by udid or serial ?) in particular for the osinfo one

Hi @Vlad Previn Seems you can do this the following way:

SELECT os.*, si.*, oi.* FROM os_version os, system_info si, osquery_info oi;

ty that works 🙂 . tho i have no idea how it knows that i want to join it by uuid (?)

If the join-operator is "CROSS JOIN", "INNER JOIN", "JOIN" or a comma (",") and there is no ON or USING clause, then the result of the join is simply the cartesian product of the left and right-hand datasets. If join-operator does have ON or USING clauses, those are handled according to the following bullet points:

Given that these tables all have one row, then the result is all columns in one row.

oh right. so it basically works ….because it’s one row result in all 3 tables 🤔 and there’s no implied join. i see thank you for explaining