regular queries just contain the time osquery saw the change then, right?