@andrew you can also use many outputs for scheduled query results. so you can log to something like kolide AND your custom splunk endpoint or whatever. which is a very nice way to transition or something.