topic Re: Problems Deleting Data in Splunk 6 in Getting Data In

Problems Deleting Data in Splunk 6

conner9 — Tue, 29 Oct 2013 15:06:39 GMT

Trying to delete data from an index for a specific day, and keep getting an error.

index=os sourcetype=ps provides 600k results for a single day.

index=os sourcetype=ps | delete results in "job terminated unexpectedly" "search terminated because of an error"

Yes the account has the delete functionality.

Thanks in advance for any thoughts.

Re: Problems Deleting Data in Splunk 6

jtrucks — Tue, 29 Oct 2013 16:14:10 GMT

Have you tried deleting data for only a couple hours or some other shorter period of time? It is possible you are hitting resource constraints that are messing with the completion of the job.

Re: Problems Deleting Data in Splunk 6

conner9 — Tue, 29 Oct 2013 16:42:22 GMT

I did, and it was still failing.

Re: Problems Deleting Data in Splunk 6

conner9 — Tue, 29 Oct 2013 16:42:40 GMT

I found my particular problem. Some of the files in my index directory were owned by root, and it was preventing my deletes from taking affect. As soon as I reset ownership to splunk:splunk, it started working again.