Issue

My Scheduled Rule in Panther has fallen behind—i.e., its associated Scheduled Search is stuck querying data from a long time ago, and there's no way for it to catch up. I received the following System Error:

Query X is Y behind schedule, check query history for errors or performance issues

How can I fix this?

Resolution

To resolve this issue, either:

Cause

Scheduled Searches run on intervals, and this issue arises when a Scheduled Search takes longer than its interval to finish executing. Even if a query ordinarily executes within its scheduled interval, its execution time may be extended due to unexpected disruptions.

Disruptions can be things like: