I’m not sure there’s a way to estimate the expected size. osquery is hitting some underlying OS api, and doesn’t know what the data is likely to be