diff --git a/docs/pages/admin-guides/access-controls/access-monitoring.mdx b/docs/pages/admin-guides/access-controls/access-monitoring.mdx
index 13e6876458b0a..b1d80d2f3e82a 100644
--- a/docs/pages/admin-guides/access-controls/access-monitoring.mdx
+++ b/docs/pages/admin-guides/access-controls/access-monitoring.mdx
@@ -561,3 +561,5 @@ $ tctl audit query exec 'select event_time,identity_user from cert_create order
 ```
 
 The query result is returned as a JSON array of arrays. The first array contains the column names, and the subsequent arrays contain the query results.
+
+By default, `tctl audit query exec` will search over the past 7 days. You can specify an alternate time frame with the `--days=N` flag.