osquery> SELECT * FROM rpm_packages WHERE name IN ('zlib', 'yum', 'which', '', NULL, 'gwnviwjiworjnv');
...
osquery planner: xFilter Adding constraint to cursor (1): name =
osquery planner: xFilter Adding constraint to cursor (1): name = gwnviwjiworjnv
osquery planner: xFilter Adding constraint to cursor (1): name = which
osquery planner: xFilter Adding constraint to cursor (1): name = yum
osquery planner: xFilter Adding constraint to cursor (1): name = zlib
...
+-------+---------+----------------+----------------------------------+---------+------------------------------------------+--------+-------+--------------+--------+------------------------------+
| name  | version | release        | source                           | size    | sha1                                     | arch   | epoch | install_time | vendor | package_group                |
+-------+---------+----------------+----------------------------------+---------+------------------------------------------+--------+-------+--------------+--------+------------------------------+
| which | 2.20    | 7.el7          | which-2.20-7.el7.src.rpm         | 76962   | 01530fd2bd615864e31bb31c1fbd0fd590f3c702 | x86_64 |       | 1707852703   | CentOS | Applications/System          |
| yum   | 3.4.3   | 168.el7.centos | yum-3.4.3-168.el7.centos.src.rpm | 5829237 | 946a3d8da1cd710a343f0cdc8bf7b50efca93822 | noarch |       | 1707852753   | CentOS | System Environment/Base      |
| zlib  | 1.2.7   | 21.el7_9       | zlib-1.2.7-21.el7_9.src.rpm      | 185206  | 90bcb1700b0b5e68692f0075dbf8c8bfa2f32d21 | x86_64 |       | 1707852700   | CentOS | System Environment/Libraries |
+-------+---------+----------------+----------------------------------+---------+------------------------------------------+--------+-------+--------------+--------+------------------------------+

osquery> SELECT * FROM rpm_package_files WHERE package IN ('zlib', 'yum', 'which', '', NULL, 'gwnviwjiworjnv');
...
osquery planner: xFilter Adding constraint to cursor (1): package =
osquery planner: xFilter Adding constraint to cursor (1): package = gwnviwjiworjnv
osquery planner: xFilter Adding constraint to cursor (1): package = which
osquery planner: xFilter Adding constraint to cursor (1): package = yum
osquery planner: xFilter Adding constraint to cursor (1): package = zlib
...
+---------+-----------------------------------------------------------+----------+-----------+------+--------+------------------------------------------------------------------+
| package | path                                                      | username | groupname | mode | size   | sha256                                                           |
+---------+-----------------------------------------------------------+----------+-----------+------+--------+------------------------------------------------------------------+
| which   | /usr/share/doc/which-2.20/README                          | root     | root      | 0644 | 4433   | 680debfe517546b48b9d76943eecb47e3ce1360f516496741e1a6b1852e4c53b |
...
| yum     | /usr/share/doc/yum-3.4.3/README                           | root     | root      | 0644 | 1078   | 3d52ed91258700fa5cb7396fe6f60086a94e3daa80afc5a30ebab2508a5f88b7 |
...
| zlib    | /usr/share/doc/zlib-1.2.7/README                          | root     | root      | 0644 | 5185   | a4dfc7f4225a68315763aafb536428852aff6dd3135ab4e0cdc9e3e6a65fd796 |
+---------+-----------------------------------------------------------+----------+-----------+------+--------+------------------------------------------------------------------+