Tools · Endpoint visibility · 22 / 25
osquery: calendarTime and unixTime are one instant
On one result line, calendarTime and unixTime are the same moment in two writings. They are not two events. Write one instant, and do not subtract them to invent a duration.
The line has one clock
A scheduled result can print calendarTime as a readable stamp and unixTime as a number. Both refer to when that line was logged. Converting the number should land on the readable stamp. They are not a start and an end.
If one of the two is missing, write which one is missing. Do not invent the other by assuming they disagree.
A duration needs two lines
A gap is the difference between two lines. One line cannot contain a gap inside its own pair of formats. Subtracting the readable stamp from the number, or treating them as hours apart, misreads a conversion as a wait.
If the two formats on one line do not convert into each other, write that the line disagrees with itself and do not pick a third time.
What to file
File one instant for the line, and show both writings if you keep them. Label them as the same moment. A second instant needs a second line.
Worked case: one line read as a two-hour gap
A lab line shows calendarTime 2026-11-03 15:04:11 UTC and unixTime 1793718251, which is that same minute. A draft subtracts a mis-copied number and says the query waited two hours between the two fields.
The note says both fields are 15:04:11 UTC on that one line. There is no duration inside the line. A duration would require another line’s instant.
one line calendarTime: 2026-11-03 15:04:11 UTC unixTime: the same minute write: one instant not: a two-hour gap inside the line
Diagram
Two writings of one instant
Convert them. Do not subtract them.
Is. The readable stamp on this line
Means. When this line was logged
Does not. Start a duration by itself
Is. That same moment as a number
Means. The same logging instant
Does not. End a duration against the stamp
Check yourself
1. A line shows a calendar stamp and a unixTime that convert to the same minute. How many instants is that?
2. When can you compute a duration from osquery times?
3. The number does not convert to the stamp on that line. What do you write?