The search failed. More than 125000 events found at time

[ddholstadz]

I get this error which I suspect is from reading in a file whith no timestamps in it?

Error in 'IndexScopedSearch': The search failed. More than 125000 events found at time 1293916026.

1) Is there an easy way to see which file caused the error 2) Is there a was to force Splunk to spread the file across multiple timestamps?

[sideview · Accepted solution]

This has come up several times before. You can see other answers by searching the site for 'IndexScopedSearch'.

here are two:

http://answers.splunk.com/questions/303/whats-max-events-i-can-have-timestamped-with-a-particular-se...

http://answers.splunk.com/questions/3397/indexscopedsearch-error-details