Search code examples
osquery

how to save console result of osquery as a csv or excel in windows


I am working with OSQUERY, I want to save result of osquery to a particular file as excel or csv.

I am trying with below but not getting what I want

$ osqueryi --json 'select * from osquery_info' > res.json

$ cat res.json

{"build_distro":"10.12","build_platform":"darwin","config_hash":"e7c68185a7252c23585d53d04ecefb77b3ebf99c","config_valid":"1","extensions":"inactive","instance_id":"38201952-9a75-41dc-b2f8-188c2119cda1","pid":"26255","start_time":"1552676034","uuid":"4740D59F-699E-5B29-960B-979AAF9BBEEB","version":"3.3.0","watcher":"-1"} ]

When I fire below query

osquery> select * from time;
+---------+------+-------+-----+------+---------+---------+----------+------------+----------------+------------+------------------------------+----------------------+----------------------+--------------------+
| weekday | year | month | day | hour | minutes | seconds | timezone | local_time | local_timezone | unix_time  | timestamp                    | datetime             | iso_8601             | win_timestamp      |
+---------+------+-------+-----+------+---------+---------+----------+------------+----------------+------------+------------------------------+----------------------+----------------------+--------------------+
| Friday  | 2019 | 8     | 23  | 12   | 24      | 45      | UTC      | 1566563085 | UTC            | 1566563085 | Fri Aug 23 12:24:45 2019 UTC | 2019-08-23T12:24:45Z | 2019-08-23T12:24:45Z | 132110366857557098 |
+---------+------+-------+-----+------+---------+---------+----------+------------+----------------+------------+------------------------------+----------------------+----------------------+--------------------+
osquery>

I want to save this output into excel or csv.


Solution

  • osqueryi documents a --csv flag. Does that do what you want? (--json outputs json.)

    Depending on what you're doing, many people use osquery as a daemon (or service) with scheduled queries.