@zwass, we don't have an issue per se. I was just confirming that I'd seen what Alejandro was describing with ah-hoc queries from the UI. I don't think it's going to affect us too much as we'll be scheduling as much as we can since ad-hoc queries aren't logged, and we rely on reviewing the results of our queries in our Splunk env. Also, if we do run ah-hoc queries, I'm guessing we'll use fleetctl more than the UI.