Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hello looking to see if anyone has a way to pull all events from the windows_eventlog table?
I know you can do something like this
```SELECT * FROM windows_eventlog
WHERE eventid=4720 AND channel='Security'```
But i am looking to just pull everything from the Security channel but from my understanding you can wildcard a integer. So something like
```SELECT * FROM windows_eventlog
WHERE eventid=% AND channel='Security'```

Not tried but I would expect `&gt;= 0` to work there?

although wait, does it even need the eventid?

As far as I can see from the code the eventid constraint is optional

`SELECT * FROM windows_eventlog WHERE channel='Security'` seems like it ought to work.