Hello, why is it that my online query on Fleet UI is not the same as my differential query?I ran a query on Fleet UI every half an hour and found no change, while using a differential query generated logs every half an hour

Is it definitely a differential query? If you are getting the same log every time the query runs maybe it is set for

snapshot: true

?

Hello, I set the difference query

This is the

General indicators

pack we are looking at?

Yes, that's the overall metric we're looking at

Can you run

--verbose --tls_dump

on the host and double-check that Fleet is not sending

"snapshot": true

for that query?

OK, I will save the result and reply to you