This topic describes default search timeout behavior, configuration of the search timeout duration, and the error message that appears when a search timeout occurs.

Note: For more information about the /etc/cb/cb.conf file, see Carbon Black EDR Server Configuration Guide.

A search timeout error displays if the search does not complete across all process events that occurred in the selected time range. The search timeout duration is set to 30 seconds by default, but this value is configurable using the ProcessAnalysisEventSearchTimeout setting in the /etc/cb/cb.conf file.

If the search times out, the following error message displays:

Search timed out. Please try narrowing search criteria.

Even if a timeout occurs, process events that matched the search criteria within the configured timeout duration can be returned; that is, a partial set of results can be returned.

To avoid a timeout, narrow the selected time range or narrow the search and filter criteria.