1) That error you're hitting in IndexScopedSearch is because when there are hundreds of thousands of events indexed in a single second, splunk will run into fundamental memory problems.
At base the fix you need to make is in how one or more data inputs are configured, and the question is answered quite well over here:
http://splunk-base.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-...
2) This is not directly related to the error message, but I suspect there's also a missing space in your search as posted and maybe another typo? because running that permalink the search looks like this:
* | regex_raw="%SYS-5-CONFIG_I:"
Last 24 hours
there is no search command called regex_raw, although it seems obvious that you intended | regex _raw? And the newline character followed by 'Last 24 hours' in the search bar looks very strange indeed and I doubt its doing anything useful.
3) This is also not directly related to your error but assuming that you meant to run the rex command and run a regex on the _raw field, its worth mentioning that searching for "*" and then piping that to a rex command on _raw is always going to be an extremely inefficient way to go. search * means that the splunk index has to get every single event off disk and run that regex against it.
So if there's any kind of search terms you can put in that initial search clause, it will allow splunk to do less work and that will pay off immensely in search performance.
