I'm specifically exploring whether or not the ability to run queries quickly would be of value to a hunt-type situation - or more generally speaking, are enterprises losing out because complex queries take too long to run. Selfishly, I'm on the security side, so I think SIEM. But, generally, application-level logging may have the same problem.