# agent's SIEM query timed out on a 90-day lookback: window chunking

## TL;DR

The 90-day query is too big for one execution, so the SIEM times out. Chunk it: run the same query over 7-day windows, aggregate the results, and parallelize the chunks. Long lookbacks are many short queries, not one long one.

```text
agent's SIEM query timed out on a 90-day lookback
```

## Steps

1. Confirm the timeout is size-driven: the same query over 7 days completes.
   Expected: Chunking is the fix.

2. Split the 90 days into 7-day (or 1-day) windows and run the query per window.
   Expected: Each chunk completes.

3. Aggregate the chunk results with the same logic the single query would use.
   Expected: The answer matches the unchunked intent.

4. Parallelize the chunks within the SIEM's concurrency limits.
   Expected: The full run finishes fast.

5. Save the chunked pattern as the default for long lookbacks.
   Expected: The next long query starts chunked.

## When to use

- SIEM queries time out on long lookbacks
- the same query works on short windows
- the SIEM has execution time limits

## When not to use

- short windows also time out (the query itself is the problem)
- the SIEM supports the long query with a higher timeout (raise it deliberately)
- the data does not exist for the full window (check retention first)

## Tool compatibility

- any SIEM
- long-lookback hunting queries

## Variant phrasings

- "SIEM query timeout 90 day lookback"
- "chunk SIEM query windows"
- "long lookback query times out"

## Why it happens

SIEMs bound query execution time and memory; a 90-day scan over high-volume indexes exceeds both. The query is not wrong, it is just too big for one execution. Chunking respects the engine's limits while answering the same question, and the aggregation is exact for counts and sums.

## Edge cases

- the chunk boundaries must not drop or double-count boundary events; use half-open intervals
- aggregations like distinct-counts need sketch-aware merging across chunks
- the SIEM's concurrency limit applies to your chunks too; do not self-throttle into a ban

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_iRFdw4It5W1tnA8cZItxfQ