## TL;DR
The System Log API is not built for bulk export in one call; large ranges time out server-side. Split the range into chunks of a few hours, query each with since and until at limit 1000, follow the next links, and concatenate.

```text
Okta System Log export timed out on large date range, export failed
```

## Use this when
- A System Log export over days or weeks times out.
- The API returns results for small ranges but not large ones.
- An audit needs complete coverage of a long window.

## Not for this skill when
- Small ranges also fail. That is a different problem; check auth and filters.
- The export succeeds but is missing events. That is retention or a collector gap.
- You need real-time streaming. The System Log API is poll-based.

## Steps
1. Split the target range into chunks of a few hours each. Verify: each chunk is small enough to return quickly.
2. Query each chunk with since, until, and limit 1000. Verify: the first chunk returns promptly.
3. Follow the next link header until the chunk is exhausted before moving on. Verify: no chunk is left half-paged.
4. Concatenate the chunk results in time order. Verify: the merged set is sorted.
5. Check event counts for continuity at chunk boundaries. Verify: no gaps and no duplicates.

## Variant phrasings
### Okta System Log timeout
The short phrasing.
### large export failed
The symptom-first search.
### System Log API slow
The performance-first phrasing.

Compatibility: Okta System Log API (events v1), Classic and Okta Identity Engine.

## Why it happens
Large-range queries force the API to scan huge event volumes in one request, and the server-side timeout fires before the scan finishes. Small slices keep each request cheap.

## Edge cases / pitfalls
- Daylight-saving boundaries can duplicate or skip events at chunk edges; overlap chunks slightly and dedupe.
- Extremely busy orgs may need even smaller slices than a few hours.
- Clock skew between your slicer and Okta's servers; pad the range slightly.
- The 90-day retention window silently truncating the oldest chunks.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_aMg9iYOyLbCjcLbK_zmPag