Troubleshoot server errors in scheduled correlation rules ↗

Abstract

Learn more about how to troubleshoot server errors in scheduled correlation rules.

When you encounter any server errors in scheduled correlation rules, there are some steps you can perform to address the issues depending on the type of error. Follow the steps below to help troubleshoot the issue.

These errors indicate that the Cortex Query Language (XQL) query for the scheduled correlations rule is complex, broad, or exceeding resource limits. To fix the query, perform the following:

Run the query for the scheduled correlation rule in the Query Builder to identify syntax issues or logic errors introduced by any recent changes.
Review your query and decide which actions you can perform to fix the query:
- Simplify the query by removing any fields that are not essential for the required results.
- If the query covers an extended period, reduce the time frame.
- If real-time correlation rules are supported and being used, consider converting your query to this mode.
- When queries involve complex operations, such as comp, precede these with a fields stage to set only the necessary fields required to include in the query results.
- Divide overly complex or data-heavy queries into multiple, simpler correlation rules.
- If the scheduled correlation rule includes a datamodel stage, in certain cases, it may be beneficial to apply filters, joins, and computations directly on the original dataset fields, rather than on the normalized Cortex Data Model (XDM) fields.

A server error occurred while generating the alert.

This error typically points to issues with the output alert configuration's complexity or content. Consider taking the following actions:

Simplify the query output by excluding non-essential fields and any fields that may contain excessively large data.
In some cases, the size of the query output can include fields that are too large to allow alerts to be generated successfully. To avoid this, we recommend setting boundaries that improve the chances of the correlation rule running successfully over time by performing the following:
- Limit the length of the calculated array fields by using the arrayrange() function. For more information, see arrayrange.arrayrange
  Example 188.
  Limits the length of the calculated array_field field to return only the first 1000 elements:
  arrayrange(array_field, 0, 1000)
- Limit the length of string fields set to an unlimited length using the trim function. For more information, see ltrim, rtrim, trim.ltrim, rtrim, trim
  Example 189.
  Limits the length of the string_field field, which is set to an unlimited length, to return the first 1000 characters:
  rtrim(string_field, len(string_field) - 1000)
Reduce the length and complexity of the Alert Name, Description, and any associated Drill-Down Query.
Temporarily remove any mapped fields from the alert configuration.
If present, verify the existence of the fields within the table. Temporarily remove suppression fields from the alert configuration.
Use Static Severity: If dynamic severity is in use, switch to static.