Skip to main content
Panther Knowledge Base

My Scheduled Rule in Panther has fallen behind and cannot catch up. How do I resolve this?

  1. Last updated
  2. Save as PDF

Issue

My Scheduled Rule in Panther has fallen behind—i.e., its associated Scheduled Search is stuck querying data from a long time ago, and there's no way for it to catch up. I received the following System Error:

Query X is Y behind schedule, check query history for errors or performance issues

How can I fix this?

Resolution

To resolve this issue, either:

  • Tune your Scheduled Search to run faster, then let it catch up. To allow enough time for catch-up, ensure your query can finish executing at least five times within its scheduled interval.
  • Deactivate, then reactivate, your Scheduled Search. This will reset it, but not prevent the same kind of behavior from arising again in the future.

Cause

Scheduled Searches run on intervals, and this issue arises when a Scheduled Search takes longer than its interval to finish executing. Even if a query ordinarily executes within its scheduled interval, its execution time may be extended due to unexpected disruptions.

Disruptions can be things like:

  • An AWS issue
  • The query times out
  • The query suddenly starts taking a long amount of time
  • A Snowflake issue