Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 10 replies
  • Answers 1 answer
  • Subscribers 15 subscribers
  • Views 1904 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

"Looping" through list in Live Query

Kyle Parrish

Good afternoon!

I am working on a query where I would like to essentially perform a "For Each Loop" on the results.

I am not sure what the SQL equivalent is.

Can someone assist me and/or direct me to the proper syntax?

Based on the following query, I would like to "grep" each of the file paths for a string.

SELECT path, directory, filename FROM file WHERE directory LIKE 'C:\users\%\AppData\Local\Google\Chrome\User Data\Default%%' AND filename IS 'Preferences'

Example grep query to be run on each discovered file path:

SELECT line FROM grep WHERE pattern = 'test' AND path = 'C:\users\bobjoe\AppData\Local\Google\Chrome\User Data\Default\Preferences'

Thanks!



This thread was automatically locked due to age.
Parents
  • 0

    Does this example help:

    select json_extract(line,'$.timeStamp')as TimeStamp,json_extract(line,'$.serviceName') as ServiceName,json_extract(line,'$.resourceId')as ResourceID from grep where pattern ="{" and path in (select path from file where directory = 'C:\ProgramData\Sophos\Health\Event Store\Trail')

    This pulls out a few values from the json files in a directory.

  • 0 in reply to Sophos User930

    This helps very much and works as is. However, when I try to apply it to my use case I get nothing. This is what I have so far:

    select json_extract(line,'$.account_info.email') as state, path from grep where pattern ="{" and path in (select path from file where directory LIKE 'C:\users\%\AppData\Local\Google\Chrome\User Data\Default%%' AND filename IS 'Preferences')

  • 0 in reply to Kyle Parrish

    I keep getting:

    finished – errors – malformed JSON

    Anything odd about the Chrome Preferences JSON?

Reply Children
Unfiltered HTML