This question is for a splunk 2 site cluster environment (Splunk 6.1.3). We have 2 searchable copies for every index – one in each site. A few of the events for an index are deleted in site-1 using a search and delete operation through a search head. As per the splunk documentation this delete will be synced to the other site. But that is not happening! The deleted events are still present in site-2 even after 3 days.
I just tested and double checked that delete on site 1 got replicated to site 2, for this to work only requirement is to have the splunk management port open between all peers under cluster master (i.e for all sites).
I just tested and double checked that delete on site 1 got replicated to site 2, for this to work only requirement is to have the splunk management port open between all peers under cluster master (i.e for all sites).
