I have add the below config in limit.conf but still not work, not sure any other setting, would you please advise? Thanks. [scheduler] max_action_results = 100000 ... View more

The problem is solved by an input whose sourcetype is set to automatic, most likely from a file or directory input. http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Bypassautomaticsourcetypeassignment However, in 6.2+ I am not seeing a way to set sourcetype to automatic when setting up new data inputs. Best thing I can suggest is too do two things: Run: $SPLUNK_HOME/bin/cmd btool inputs list --debug to display all inputs and try to determine erroneous sources of data, disable or modify where necessary. Move $SPLUNk_HOME/etc/apps/learned/local/props.conf and $SPLUNk_HOME/etc/apps/learned/local/sourcetypes.conf to a temp directory and restart Splunk. This was successful for me today. Hope this helps - Good Luck! ... View more