diff --git a/docs/pages/admin-guides/access-controls/access-monitoring.mdx b/docs/pages/admin-guides/access-controls/access-monitoring.mdx
index 2ab7cd517019..f114ecfdb884 100644
--- a/docs/pages/admin-guides/access-controls/access-monitoring.mdx
+++ b/docs/pages/admin-guides/access-controls/access-monitoring.mdx
@@ -560,5 +560,6 @@ $ tctl audit query exec 'select event_time,identity_user from cert_create order
 ]
 ```
 
-The query result is returned as a JSON array of arrays. The first array contains the column names, and the subsequent arrays contain the query results. By default, tctl audit query exec will search over the past 7 days.
-You can specify an alternate timeframe with the --days=N flag.
+The query result is returned as a JSON array of arrays. The first array contains the column names, and the subsequent arrays contain the query results.
+
+By default, `tctl audit query exec` will search over the past 7 days. You can specify an alternate timeframe with the `--days=N` flag.