Interestingly, I have this as a schedule

"schedule": {
     "ping_pong": {
        "query": "select year, month, day from time;",
        "interval": 10
       }
  },

but I don't see it show up in either my tls endpoint, or in aws_firehose, or in the results.log

Run

osqueryd

with

--verbose

and see if it logs that the query is being executed.

oh.

Yes. Or make the query return a different result each time (

select unix_time

)

👍 got it, thanks!