@Carlos López Hi! Although it seems that the query is run twice, it's only run once but it returns 2 rows, because that's a differential from a scheduled query. As you can see in the data, the uptime is basically 20mins apart and there is an

action

column which has

removed

in one row and

added

in the other. The differential logs do that, shows you the difference in the query results between the previous run of the scheduled query and the next. It doesn't always make sense to have a differential for all queries, especially for a table like

uptime

where the result is bound to change at each query. To change that you want to put

"snapshot": true

in the config of your query. More information at: https://osquery.readthedocs.io/en/latest/deployment/logging/#differential-logs