How do I find what source/sourcetype caused this error: "The search failed. More than 1000000 events found at time"

[xindeNokia]

Search failed with error msg:

Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time 1554154800.

How do I find out what source/sourcetype/event caused this issue?

I have tried a couple of queries:

1. *somecontents earliest=1554154800 | head 1000

It takes a long time — still on going and nothing matched

2.
*somecontents earliest=1554154799 latest=1554154801
| head 1000

Returns the same search failure error.

Any help is appreciated!

[bigg_bear]

Did you solve the problem after finding out what sourcetype caused this issue?

[somesoni2 · Accepted solution]

Give this a try

| tstats count WHERE index=* _time=1554154800 by index sourcetype

[xindeNokia]

Thank you for the quick help!!