Hello, I am trying to get a machine's boot time in a 'diff' mode scheduled query - meaning that I want to get new results only after a machine reboots.

uptime

table can provide the time since boot in seconds, and

time

table can provide the current unix time in seconds. Using this query:

SELECT time.unix_time - uptime.total_seconds boot_time FROM uptime, time

I hoped to achieve this. However, the two tables are sort of in race condition, causing one of them to sometimes be queried before the other, thus, the results that return are fluctuating between two seconds - e.g.: 1533442647 & 1533442646. The main problem with this is that now osquery will report every diff and instead of receiving one row for each boot, I keep receiving results all the time. Anyway to solve this issue? or a better way to query boot time in epoch seconds in a 'diff' mode scheduled query?