Splunk Search

How do I find what source/sourcetype caused this error: "The search failed. More than 1000000 events found at time"

xindeNokia
Path Finder

Search failed with error msg:

Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time 1554154800.

How do I find out what source/sourcetype/event caused this issue?

I have tried a couple of queries:

  1. *somecontents earliest=1554154800 | head 1000

It takes a long time — still on going and nothing matched

2.
*somecontents earliest=1554154799 latest=1554154801
| head 1000

Returns the same search failure error.

Any help is appreciated!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| tstats count WHERE index=* _time=1554154800 by index sourcetype

View solution in original post

0 Karma

bigg_bear
Engager

Did you solve the problem after finding out what sourcetype caused this issue?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| tstats count WHERE index=* _time=1554154800 by index sourcetype
0 Karma

xindeNokia
Path Finder

Thank you for the quick help!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...