I haven't, I was using procmon to see where all the writes were going - this just showed most of the calls going to the .log and .sst files. I then changed my configured scheduled queries to remove everything except the joined query and still got the large numbers vice versa with the windows_events table saw the numbers come down