The typical pattern is to use "differential logs" (http://osquery.readthedocs.io/en/stable/deployment/logging/#differential-logs) and not specify time ranges in the scheduled queries.