https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327164#M60772 <P>Some of the errors numbers look an awful lot like an integer overflow/underflow. I'd say this is probably a bug, something treating an integer as signed in some places, unsigned in others ...</P> <P>2^64 - 18446744073709539157 = 12459<BR /> 2^64 - 18446744073709539122 = 12494</P> <P>Both of these are really near the order of magnitude of other values of 'errors' in the screen shot. Smells plausible.</P> Sun, 10 Sep 2017 20:31:18 GMT dwaddle 2017-09-10T20:31:18Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327162#M60770 <P>When deleting via <CODE>index=xxx sourcetype=yyyy | delete</CODE> I got the following page -</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3477i823EC6DEC3E8FBF7/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>So, in addition to the proper <CODE>index xxx</CODE> report of 0 errors for the various indexers, I also got these lines for the different indexers. Why do they mean?</P> Fri, 08 Sep 2017 23:20:44 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327162#M60770 ddrillic 2017-09-08T23:20:44Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327163#M60771 <P>Wow - I don't know what happened here, but you are deleting a boatload of data. It's possible that you have exceeded the design specs for the delete command.</P> <P>I suggest that you search the internal log files for more information. Try this search, being sure to set the timerange to just around the time of the delete command:</P> <PRE><CODE>index=_internal OR index=_audit log_level=error OR log_level=warn </CODE></PRE> <P>Hopefully that will give you more info...</P> Sun, 10 Sep 2017 17:41:43 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327163#M60771 lguinn2 2017-09-10T17:41:43Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327164#M60772 <P>Some of the errors numbers look an awful lot like an integer overflow/underflow. I'd say this is probably a bug, something treating an integer as signed in some places, unsigned in others ...</P> <P>2^64 - 18446744073709539157 = 12459<BR /> 2^64 - 18446744073709539122 = 12494</P> <P>Both of these are really near the order of magnitude of other values of 'errors' in the screen shot. Smells plausible.</P> Sun, 10 Sep 2017 20:31:18 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327164#M60772 dwaddle 2017-09-10T20:31:18Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327165#M60773 <P>Very interesting!!!!! </P> Mon, 11 Sep 2017 01:37:22 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327165#M60773 ddrillic 2017-09-11T01:37:22Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327166#M60774 <P>Perfect - let me try.... </P> Mon, 11 Sep 2017 01:38:03 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327166#M60774 ddrillic 2017-09-11T01:38:03Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327167#M60775 <P>And the <CODE>index=__ALL__</CODE> - what's that?</P> Mon, 11 Sep 2017 01:39:01 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-get-errors-for-index-ALL-when-using-delete/m-p/327167#M60775 ddrillic 2017-09-11T01:39:01Z