@njhartwell, the way to do that is to create a query pack with

select * from cpu_time

and then do the math you are looking to do on the kafka side - ie., you have a kafka client that looks for two consecutive updates from osquery to your query pack, and then does the difference calculation.