Ha. I've been noodling at https://osquery.slack.com/archives/C08V7KTJB/p1517523964000415 recently. For our use, I ended up doing snapshots and intervals. Intervals are for alerting, and snapshots are for better fit for "how much data to search to figure out history". I kinda wish the conf language made it easier to stick them together.... But, if you've got enough TLS api in place, the epoch stuff feels cleaner anyhow