Here is the entire story - events are supposed to be unique so they can not be duplicate (provided you are not using --events_optimize=false ). By default(--events_optimze is set to true) osquery returns new results every time you query an event table. So there is no question of you getting same events again provided we dont have the bug in the logic.