I have enabled process auditing. I tested it on Linux by using "useradd" to create a new user. When I look at the resulting OSQuery data in Splunk, I see that there are five messages that all contain the same fields except for the "uptime" value. It has gone steadily up. Can anyone think of why OSQuery would essentially be reporting the same process event multiple times?