Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I have a question about intervals for decorators. Let’s say I set an interval of one day. Does that mean the query result is cached for a day and sent with every other query, or that it is a decorator once a day? I suspect the former, but would like to confirm. 

that is how the "load" logic works, runs the decorator query once and then every subsequent message has the result appended.

Thank you that gives me confidence my assumption is correct. I guess I should just test 

we have used it this way in a very large fleet deployment for years now. we guarantee fields to support joining in our data lake amongst other things

I've seen nodes set with `load` decorators just not send the expected decorated results. Never did get to the bottom of it, and it only happened to a very small number of nodes. I was still curious how the `interval` worked for decorators but never got to the bottom of it. Seemed like I'd need to read the source since the docs weren't clear. This is the entire section:
```The interval type uses a map of interval 'periods' as keys, and the set of decorator queries for each value. Each of these intervals MUST be minute-intervals. Anything not divisible by 60 will generate a warning, and will not run.```

I guess that is just describing the format of the config, i.e. from the example:
```    "interval": {
      "3600": [
        "SELECT total_seconds AS uptime FROM uptime;"
      ]
    }```
The name implies that the results of these decorator queries are run every hour (3600 seconds), and I assume whatever value they return will be used to decorate all other results similar to the `load` variety which just runs once.

And the value of the decoration would change every hour when the query is run on its interval.