topic Re: IndexScopedSearch Error in Splunk Search

IndexScopedSearch Error

ryastrebov — Mon, 01 Apr 2013 05:27:53 GMT

Hello Splunkers!

During search I get an error: "Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time 1361015487."

Which parameter in the limits.conf file should I increase to avoid this error?

Best regards,
Roman

Re: IndexScopedSearch Error

ryastrebov — Mon, 01 Apr 2013 11:23:59 GMT

Not have any ideas?

Re: IndexScopedSearch Error

smolcj — Mon, 01 Apr 2013 12:37:30 GMT

i think both are same . please check out [here][1]

 [1]: http://splunk-base.splunk.com/answers/3397/indexscopedsearch-error-details

Re: IndexScopedSearch Error

ryastrebov — Mon, 28 Sep 2020 13:39:01 GMT

Thank you!
I found this answer earlier. But I do not quite understand what kind of setting it:
"parameter tunable based on memory available"

Increase value of parameter "max_mem_usage_mb" doesn't affect the Error...

Re: IndexScopedSearch Error

ryastrebov — Mon, 01 Apr 2013 16:19:35 GMT

The problem is still not resolved...

Re: IndexScopedSearch Error

a212830 — Thu, 11 Apr 2013 17:30:41 GMT

Curious as well - running into the same situation.

Re: IndexScopedSearch Error

a212830 — Thu, 11 Apr 2013 17:32:44 GMT

Curious as well - having the same issue.

Re: IndexScopedSearch Error

ryastrebov — Fri, 12 Apr 2013 07:00:49 GMT

Maybe this is hard limitation of Splunk?...

Re: IndexScopedSearch Error

jalfrey — Wed, 29 Jan 2014 19:13:58 GMT

Splunk returns searches in sub second order. You can not have more the 100K events indexed in one second. It is not tunable. Sorry.

Re: IndexScopedSearch Error

wrangler2x — Mon, 13 Apr 2015 23:01:13 GMT

I had this same problem in an index taking various exchange log files. After reading this comment about the 100K events indexed in one second being a limitation, I started thinking about that. I have not had this problem before upgrading to splunk 6.1.5 (I was on 4.3.1 before). I looked at their timestamps and realized that these logs are granular only to the second. So I go in touch with the admin on that system, and suggested moving to advance logging, and turning-on millisecond timestamps. I had to re-do my props.conf for the new timestamp but that was trivial, and I am not experiencing this error any more when searching. When you make this change, you switch from monitoring where the log is and the name:

W3SVC1\u_ex*.log to AdvancedLogs\DEFAULT WEB SITE\Exchange_AdvLog_H*.log

I put this in my props.conf for the new format:

detect_trailing_nulls=auto
pulldown_type = true
SHOULD_LINEMERGE = false
CHECK_FOR_HEADER = false
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
TZ = GMT