topic Re: Why can deleted events reappear? in Getting Data In

Why can deleted events reappear?

HeinzWaescher — Fri, 08 Jan 2016 09:23:55 GMT

Hi,

we're experiencing that deleted events reappear and are searchable again. It seems to happen randomly from time to time.
What can be the reason for this behaviour?

Thanks in advance
Heinz

Re: Why can deleted events reappear?

jmallorquin — Fri, 08 Jan 2016 10:36:06 GMT

Have you check the _indextime to check if the event is new?

Hope i help you

Re: Why can deleted events reappear?

HeinzWaescher — Fri, 08 Jan 2016 10:53:59 GMT

Yes, I've checked the indextime. These are definitely old events.

Re: Why can deleted events reappear?

Lowell — Fri, 08 Jan 2016 15:34:10 GMT

Can you provide additional details about your environment? Single server, distributed, are you doing any index clustering/replication?

Keep in mind that events aren't truly "deleted" they are simply marked as hidden. So it's possible something is getting messed up in the file that contains the list of deleted events (per bucket). If you are deleting things regularly, you may want to look at why that is, as frequent deletes cause frequent bucket roles, which can impact performance.

Sounds like this may be a good candidate for a support ticket, especially if you can reproduce it or show multiple examples of when this has happened.

Re: Why can deleted events reappear?

yannK — Sat, 09 Jan 2016 17:45:27 GMT

Are you in an indexer cluster ?

Re: Why can deleted events reappear?

HeinzWaescher — Mon, 11 Jan 2016 08:28:27 GMT

Yes, we are working in a cluster. And we are deleting events several times per week...
Can we do some kind of maintenance work to fix this list of hidden events?

Re: Why can deleted events reappear?

gfuente — Thu, 04 Feb 2016 18:28:19 GMT

I found the same behaviour. In cluster. Deleted events reappeared after a deploy cluster bundle . Splunk 6.3.1