# Look back time and maxspan in eql **URL:** \ **Category:** Elastic Security\ **Created:** [May 6, 2024, 10:14pm UTC](https://discuss.elastic.co/t/look-back-time-and-maxspan-in-eql/358874 "2024-05-06T22:14:51Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Esha](https://avatars.discourse-cdn.com/v4/letter/e/9de053/32.png) [@Esha](https://discuss.elastic.co/u/Esha)\ **Post date:** [May 6, 2024, 10:14pm UTC](https://discuss.elastic.co/t/look-back-time-and-maxspan-in-eql/358874/1 "2024-05-06T22:14:51Z")
Hi, Need some kind help. Do i need to schedule 1 hour look back time if im using maxspan=1hour to trace sequence of events in eql? Thank you ---
**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\ **Post date:** [May 7, 2024, 1:24am UTC](https://discuss.elastic.co/t/look-back-time-and-maxspan-in-eql/358874/2 "2024-05-07T01:24:28Z")
Hi @Esha! That's a great question. We go over some of this configuration in general [in our rule scheduling docs](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-schedule), but it's not explicit how other features may interact with that configuration. The answer to your question is that _it depends on the situation_, but yes, you probably want a longer look-back time configured if you're trying to find sequences with `maxspan=1h`. The window of data on which a rule executes (all rules, not just EQL rules) is defined as: `interval + lookback`, so if your rule executes every hour (`interval=1h`) and has an additional look-back time of 5 minutes (`lookback=5m`), each execution will be looking at the last 65 minutes of data. If the rule executed every `30m`, and still had `lookback=5m`, you could still find sequences within the specified `maxspan=1h`, but those sequences would never have an actual span exceeding the 35 minutes. In short: you'll need to configure the combination of `interval`, `lookback`, and `maxspan` to fit your use case, but hopefully the above information will help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 4, 2024, 1:24am UTC](https://discuss.elastic.co/t/look-back-time-and-maxspan-in-eql/358874/3 "2024-06-04T01:24:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.