Why do I get FailedQuery('status: cancelled error: timeout') when running my Scheduled Query in Panther?

Issue

Some of our queries have started failing with the error message FailedQuery('status: cancelled error: timeout'). Why do I get this error?

Resolution

Follow the troubleshooting steps below:

• Ensure that you don't run many different queries in parallel, since this may cause a resource overload which will throw a timeout.
• Ensure you are using the best practices for faster querying of data in Panther.

You can spot the failed queries on your Query History tab (Investigate > Query History).

• Try manually running those failed queries and check if the error keeps reproducing.

If the error persists, reach out to our support team for assistance, for faster troubleshooting, you can also forward the context below:

• Were these queries running successfully in the past?

• Feel free to forward some of the queries that failed with this specific error.

Cause

This is usually caused by a timeout in the backend.