https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/345193#M102283 <P>Try this - if it runs, then you should be able to delete it in chunks.</P> <PRE><CODE> earliest="the exact time you want to delete" | head 90000 </CODE></PRE> Wed, 02 Aug 2017 15:18:51 GMT DalJeanis 2017-08-02T15:18:51Z https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/345192#M102282 <P>So I seem to have an issue similar to the one in this question <A href="https://answers.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-second-millisecond.html">here</A> and have accidentally indexed over 1,000,000 events on the same second. I want to delete them but I can't because the search won't run because it will produce the same error as seen in the title. Is there any way to solve this without deleting the whole index?</P> Wed, 02 Aug 2017 10:18:56 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/345192#M102282 svercelli 2017-08-02T10:18:56Z https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/345193#M102283 <P>Try this - if it runs, then you should be able to delete it in chunks.</P> <PRE><CODE> earliest="the exact time you want to delete" | head 90000 </CODE></PRE> Wed, 02 Aug 2017 15:18:51 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/345193#M102283 DalJeanis 2017-08-02T15:18:51Z https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/512301#M143683 <P>The</P><PRE>| head 90000</PRE><P>does not work...</P> Tue, 04 Aug 2020 08:37:40 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/512301#M143683 secrecys 2020-08-04T08:37:40Z https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/512303#M143684 <P>Identify events with some unique keywords and use them in the search and then apply delete command. Of course earliest and latest time is required not to delete other events.</P> Tue, 04 Aug 2020 08:45:47 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-IndexScopedSearch-The-search-failed-More-than-1000000/m-p/512303#M143684 thambisetty 2020-08-04T08:45:47Z