https://community.splunk.com/t5/Getting-Data-In/delete-command-timesout-and-is-very-slow/m-p/90498#M18776 <P>I have old sources that were indexed in splunk. I'm trying to delete them but the | delete command is very slow and it always times out. I've already deleted the actual files from the disk, but from my understanding I also need to run the | delete command to the remove the indexed data. Is there a way to find out why it's so slow? I've even tried to narrow it down to ranges within in a day by specifying a custom time, but even then it times out. </P> <P>Not sure if I have too many events in my main index and that's why it's become so slow and unusable. My main index (which is the one we use) is a bit over 250GB and has over 3 billion events.</P> Mon, 15 Oct 2012 16:31:19 GMT barne_dn 2012-10-15T16:31:19Z https://community.splunk.com/t5/Getting-Data-In/delete-command-timesout-and-is-very-slow/m-p/90498#M18776 <P>I have old sources that were indexed in splunk. I'm trying to delete them but the | delete command is very slow and it always times out. I've already deleted the actual files from the disk, but from my understanding I also need to run the | delete command to the remove the indexed data. Is there a way to find out why it's so slow? I've even tried to narrow it down to ranges within in a day by specifying a custom time, but even then it times out. </P> <P>Not sure if I have too many events in my main index and that's why it's become so slow and unusable. My main index (which is the one we use) is a bit over 250GB and has over 3 billion events.</P> Mon, 15 Oct 2012 16:31:19 GMT https://community.splunk.com/t5/Getting-Data-In/delete-command-timesout-and-is-very-slow/m-p/90498#M18776 barne_dn 2012-10-15T16:31:19Z https://community.splunk.com/t5/Getting-Data-In/delete-command-timesout-and-is-very-slow/m-p/90499#M18777 <P>Which version are you running? Sometime in version 3.x there was a bug which exhibited the same symptom that you report (slow to delete.) </P> <P>One option is to run the same delete command from CLI:</P> <P>./splunk search "your search terms startdaysago=2 enddaysago=1"</P> <P>(verify by running search above first before running again with the added delete command)</P> <P>./splunk search "your search terms | delete"</P> Wed, 31 Oct 2012 18:26:04 GMT https://community.splunk.com/t5/Getting-Data-In/delete-command-timesout-and-is-very-slow/m-p/90499#M18777 the_wolverine 2012-10-31T18:26:04Z