Osquery Manager Feedback - Live Query - All Agents

I upgraded from 7.12 to 7.13 and all of my previous fleet agents were automatically unenrolled. Which is cool.
However, when I run a live query and select "All Agents", it shows as if it's going to query the five enrolled agents but when I run the query, it runs against all agents, even those that were already automatically unenrolled.
The live query then appears to be stuck waiting for responses from agents that aren't enrolled anymore.
I would cancel the live query but there's no cancel button anywhere. I'm not sure if the query at some point will time out.

Thank you for the feedback.
This is our first beta release of this feature and we are looking at the way to improve it in upcoming releases.
The default expiration of the query is currently set to 1 day.
There are some improvements we are looking to make on UX side: possibly reflect the fact that the query has expired and expose the configurable expiration to the user.

2 Likes

Awesome. Thanks for the follow up.
I'll be looking forward to future releases.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.