Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Error in 'IndexScopedSearch': The search failed

msmith12
Engager
‎06-24-2021 08:07 AM
We're trying to run a search but are getting these errors while doing so:

3 errors occurred while the search was executing. Therefore, search results might be incomplete.
  • [indexer1] Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time 1624492800.
  • [indexer2] Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time 1624510800.
  • [indexer3] Events might not be returned in sub-second order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.

We've increased our max_rawsize_perchunk limit on the indexers but are still seeing these errors. We're running Splunk Enterprise 8.0.0

How would we make this error go away? TIA!

Tags (2)
0 Karma
Reply
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...