> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/troubleshoot-server-errors-in-scheduled-correlation-rules.md).
# Troubleshoot server errors in scheduled correlation rules
**Troubleshoot server errors in scheduled correlation rules**
When you encounter any server errors in scheduled correlation rules, there are some steps you can perform to address the issues depending on the type of error. Follow the steps below to help troubleshoot the issue.
Errors related to the query
Error messages
```
A server error occurred while running the query.
```
```
This rule did not run because resources were exceeded during query execution.
```
Steps to perform
These errors indicate that the Cortex Query Language (XQL) query for the scheduled correlations rule is complex, broad, or exceeding resource limits. To fix the query, perform the following:
1. Run the query for the scheduled correlation rule in the Query Builder to identify syntax issues or logic errors introduced by any recent changes.
2. Review your query and decide which actions you can perform to fix the query:
* Simplify the query by removing any fields that are not essential for the required results.
* If the query covers an extended period, reduce the time frame.
* If real-time correlation rules are supported and being used, consider converting your query to this mode.
* When queries involve complex operations, such as `comp`, precede these with a `fields` stage to set only the necessary fields required to include in the query results.
* Divide overly complex or data-heavy queries into multiple, simpler correlation rules.
Error related to the alert
Error message
```
A server error occurred while generating the alert.
```
Steps to perform
This error typically points to issues with the output alert configuration's complexity or content. Consider taking the following actions:
* Simplify the query output by excluding non-essential fields and any fields that may contain excessively large data.
* In some cases, the size of the query output can include fields that are too large to allow alerts to be generated successfully. To avoid this, we recommend setting boundaries that improve the chances of the correlation rule running successfully over time by performing the following:
* Limit the length of the calculated array fields by using the `arrayrange()` function. For more information, see [arrayrange](https://docs-cortex.paloaltonetworks.com/access?ft:baseId=UUID-cd0db1e7-be0e-c2fe-c2cb-08021b754897).
Example:
Limits the length of the calculated `array_field` field to return only the first 1000 elements:
```
arrayrange(array_field, 0, 1000)
```
* Limit the length of string fields set to an unlimited length using the `trim` function. For more information, see [ltrim, rtrim, trim](https://docs-cortex.paloaltonetworks.com/access?ft:baseId=UUID-cfd7fb43-1bf4-607d-b47a-7bb8c9ebabd2).
Example:
Limits the length of the `string_field` field, which is set to an unlimited length, to return the first 1000 characters:
```
rtrim(string_field, len(string_field) - 1000)
```
* Reduce the length and complexity of the **Alert Name**, **Description**, and any associated **Drill-Down Query**.
* Temporarily remove any mapped fields from the alert configuration.
* If present, verify the existence of the fields within the table. Temporarily remove suppression fields from the alert configuration.
* Use Static Severity: If dynamic severity is in use, switch to static.
When to contact support team
If the steps explained above don't resolve the issue, contact our support team and provide the following details:
* The exact error message received.
* The actions which led to the error.
* A list of the troubleshooting steps you've already attempted from the list provided above.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/threat-management/detection-rules/whats-a-correlation-rule/troubleshoot-server-errors-in-scheduled-correlation-rules.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.