@Jason NG Welcome! Scheduled queries by default are logged in differential mode, which means that only the differences since a previous run are logged. Snapshot mode instead logs the results from the query every time. You can read more about this here: https://osquery.readthedocs.io/en/latest/deployment/logging/#differential-logs