<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/visualizing-macos-app-usage-with-a-little-help-from-osqueryr-mactheknife/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2018/07/06/visualizing-macos-app-usage/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>Both my <code>osqueryr</code> and <code>macthekinfe</code> packages have had a few updates and I wanted to put together a fun example (it being Friday, and all) for what you can do with them. All my packages are now on GitHub and GitLab and I’ll be maintaining them on both so I can accommodate the comfort-level of any and all contributors but will be prioritizing issues and PRs on GitLab ahead of any other platform. Having said that, I’ll mark non-CRAN packages with a <code># notcran</code> comment in the source views so you know you need to install it from wherever you like to grab sketch packages from.</p>
<p>One table that <code>osquery</code> makes available under macOS is an inventory of all “apps” that macOS knows about. Previous posts have shown how to access these tables via the <code>dplyr</code> interface I built for <code>osquery</code>, but they involved multiple steps and as I started to use it more regularly (especially to explore the macOS 10.14 beta I’m running) I noticed that it could use some helper functions. One in particular — <code>osq_expose_tables()</code> — is pretty helpful in that it handles all the <code>dplyr</code> boilerplate code and makes table(s) available in the global environment by name. It takes a single table name or regular expression and then exposes all matching entities. While the function has a help page, it’s easier just to see it in action. Let’s expose the <code>apps</code> table:</p>
<pre><code>library(osqueryr) # notcran
library(tidyverse)

osq_expose_tables(&quot;apps&quot;)

apps
## # Source:   table</code></pre>