Hi everyone, I'm currently learning osquery and have some questions about how it schedules and executes queries. Specifically, I have several queries within packs that all have the same interval. Here are my questions: 1. Behavior with Same Interval: If all queries have the same interval, what will be the behavior? 2. Execution Order: Does osquery execute the queries sequentially or in parallel? 3. Default Flag for Small/Same Intervals: Is the

schedule_splay_percent

flag enabled by default when using small or identical intervals? My Observations: 1. When queries have the same interval, they are executed within that interval. For example, with a 30-second interval, execution happens within 30 seconds, and with a 60-second interval, it happens within 60 seconds. However, I've noticed that the execution time increases as the interval increases. Why does this happen? 2. It seems like osquery executes the queries sequentially. 3. I couldn't find any information about the

schedule_splay_percent

flag. Any insights or clarifications would be greatly appreciated. Thanks for your help!

I think this is more appropriate for #general, and I think this was answered there.