From 5564234952f9a0dfc1c66f98217fba5f4153e29b Mon Sep 17 00:00:00 2001 From: Noah Talerman Date: Fri, 28 Aug 2026 12:20:10 -0400 Subject: [PATCH 1/5] Clarify report interval copy: host uptime, not Fleet polling The Interval help text and "Collecting results..." empty state both implied Fleet actively polls hosts on a schedule. In reality, a host only reports in after it's been online for the selected interval (driven by osquery's own uptime), so the old copy set the wrong expectation for why results take a while to show up. --- changes/52106-report-interval-help-text | 1 + .../pages/queries/details/components/NoResults/NoResults.tsx | 4 ++-- .../queries/edit/components/EditQueryForm/EditQueryForm.tsx | 2 +- .../edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx | 2 +- 4 files changed, 5 insertions(+), 4 deletions(-) create mode 100644 changes/52106-report-interval-help-text diff --git a/changes/52106-report-interval-help-text b/changes/52106-report-interval-help-text new file mode 100644 index 00000000000..af33d848954 --- /dev/null +++ b/changes/52106-report-interval-help-text @@ -0,0 +1 @@ +- Updated the "Interval" field help text and the "Collecting results..." empty state to explain that a host only reports in after it's been online for the selected interval, instead of implying Fleet polls hosts on a schedule. diff --git a/frontend/pages/queries/details/components/NoResults/NoResults.tsx b/frontend/pages/queries/details/components/NoResults/NoResults.tsx index 97dfe42fce0..e0a68c6bc31 100644 --- a/frontend/pages/queries/details/components/NoResults/NoResults.tsx +++ b/frontend/pages/queries/details/components/NoResults/NoResults.tsx @@ -55,8 +55,8 @@ const NoResults = ({ if (collectingResults && !disabledCaching) { const collectingResultsInfo = () => ( <> - Fleet is collecting report results.
- Check back in about {readableCheckbackTime}. + Hosts will start reporting results after they've been online for + about {readableCheckbackTime}. ); diff --git a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx index e00cbb5c804..26cfd68dc6e 100644 --- a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx +++ b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx @@ -679,7 +679,7 @@ const EditQueryForm = ({ value={lastEditedQueryFrequency} label="Interval" wrapperClassName={`${baseClass}__form-field form-field--frequency`} - helpText="This is how often your report collects data." + helpText="Hosts will start reporting results after they've been online for this long." /> diff --git a/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx b/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx index 5bc1fdb0198..54ac8944785 100644 --- a/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx +++ b/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx @@ -261,7 +261,7 @@ const SaveNewQueryModal = ({ value={selectedFrequency} label="Interval" wrapperClassName={`${baseClass}__form-field form-field--frequency`} - helpText="This is how often your report collects data." + helpText="Hosts will start reporting results after they've been online for this long." /> Date: Mon, 31 Aug 2026 12:52:53 -0700 Subject: [PATCH 2/5] Delete changes/52106-report-interval-help-text --- changes/52106-report-interval-help-text | 1 - 1 file changed, 1 deletion(-) delete mode 100644 changes/52106-report-interval-help-text diff --git a/changes/52106-report-interval-help-text b/changes/52106-report-interval-help-text deleted file mode 100644 index af33d848954..00000000000 --- a/changes/52106-report-interval-help-text +++ /dev/null @@ -1 +0,0 @@ -- Updated the "Interval" field help text and the "Collecting results..." empty state to explain that a host only reports in after it's been online for the selected interval, instead of implying Fleet polls hosts on a schedule. From 2880e577e7bbf15c7c4a9078e9196945d997a3d7 Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Mon, 31 Aug 2026 12:55:23 -0700 Subject: [PATCH 3/5] Apply suggestion from @noahtalerman --- .../queries/edit/components/EditQueryForm/EditQueryForm.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx index 26cfd68dc6e..143cf84f42f 100644 --- a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx +++ b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx @@ -679,7 +679,7 @@ const EditQueryForm = ({ value={lastEditedQueryFrequency} label="Interval" wrapperClassName={`${baseClass}__form-field form-field--frequency`} - helpText="Hosts will start reporting results after they've been online for this long." + helpText="Hosts report new results after they've been online for this long." /> From 863019035c5532ae1dfa2af9e3095006b21e47aa Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Mon, 31 Aug 2026 12:56:09 -0700 Subject: [PATCH 4/5] Apply suggestion from @noahtalerman --- .../edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx b/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx index 54ac8944785..9daa039f05b 100644 --- a/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx +++ b/frontend/pages/queries/edit/components/SaveNewQueryModal/SaveNewQueryModal.tsx @@ -261,7 +261,7 @@ const SaveNewQueryModal = ({ value={selectedFrequency} label="Interval" wrapperClassName={`${baseClass}__form-field form-field--frequency`} - helpText="Hosts will start reporting results after they've been online for this long." + helpText="Hosts report new results after they've been online for this long." /> Date: Tue, 1 Sep 2026 15:31:43 -0700 Subject: [PATCH 5/5] Move save button --- .../EditQueryForm/EditQueryForm.tsx | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx index 143cf84f42f..69996d3c2ab 100644 --- a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx +++ b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx @@ -820,19 +820,6 @@ const EditQueryForm = ({
{hasSavePermissions && ( <> - {isExistingQuery && ( - ( - - )} - /> - )}
+ {isExistingQuery && ( + ( + + )} + /> + )} )}