one thing to add to what @zwass said is that this use-case is also a good place to use the

removed: false

query modifier. if your events are configured such that you only get unique events any query, then you likely just care about the events themselves and not the fact that the old events aren't included in this result set. that's a neat way to make osquery log a stream of constant events via one query.