How do folks solve query report issues for data that's not needed frequently but the device is never online for the "daily" cadence?

Hi Shawn! Your best best would probably be shortening the interval for the report to have your best chance of catching the host before it goes offline.

@Shawn Maddock One thing to keep in mind is the interval is based on osquery uptime, not actual calendar time. So 1 day is not "once daily" but every 24 hours that osquery has been running for. You might not see results update as often as you expect if the host is never online

Did not realize that. Thank you.

Mason's suggestion is still what makes the most sense. I just wanted to call that out in case you do end up shortening the interval and still see the host not reporting results 🙂