Hey there - a question regarding osquery different...
# general
y
Hey there - a question regarding osquery differential logging: So when I schedule a query to run in diff mode I expect to get the results at the first time and upon each change. So, of course when I query tables like 'users' or 'groups' I shouldn't get many updates (lets call it static), and on tables like 'time' I should get updates upon each query (lets call it dynamic). Now my question is - if I create an sql query that joins both static and dynamic queries, yet I make sure the results don't change every query (in short I joined 'processes' table and 'time' table to get the epoch start time of each process and selected only constant columns) - what should I expect here - receive results only upon changes in data, or receive the same result upon each query due to the use of a dynamic table?