topic Re: Deleted events still showing in search summary in Getting Data In

Deleted events still showing in search summary

hughroberts — Sat, 30 Nov 2013 16:38:32 GMT

Hi all

I deleted a large number of events taken through a UniversalForwarder (v5.0.3) using the | delete command.

However these events are still showing up in the event counts on the Search summary page, they don't show up in a regular search only on the summary page.

Is there any way to fix these count totals?

Set up is clustered environment with 2 indexers, one cluster master and one search head, all servers are v5.0.3 running on Windows 2008.

Re: Deleted events still showing in search summary

ShaneNewman — Sat, 30 Nov 2013 20:44:29 GMT

Is there a chance you have used search optimization? If you have, splunk creates a summary index, meaning the historical data will still be in that summary index.

Re: Deleted events still showing in search summary

gkanapathy — Sat, 30 Nov 2013 23:40:50 GMT

It can take some time (as much as an hour or so) for the metadata to be updated after a delete command.

Re: Deleted events still showing in search summary

hughroberts — Sun, 01 Dec 2013 09:59:21 GMT

thanks for the tip, its been that way for 24 hours, think there is a bucket issue, am looking at doing a meta.dirty to force a rebuild of the metsdata.

Re: Deleted events still showing in search summary

hughroberts — Sun, 01 Dec 2013 10:01:17 GMT

hmmmm, should not be on for that specific index but its a possible, thanks for the tip, its give me some things to investigate