Deployment Architecture

Unable to delete search results

sylim_splunk
Splunk Employee
Splunk Employee

We are using 8.2.3 with SHC and multisite indexer clustering.

We have some mismatch on key business data and we need to delete and reload some data from the summary index only for a few days.

The below search returns data which is wrong and to be deleted.

Search:  index=INDEXNAME sourcetype=stash source=SOURCENAME datasource="DATASOURCENAME" host=HOSTNAME

But when I add "| delete" for the search above.  It deletes 0 events and no error.

delete_81_82.png
This worked a few months ago but not today so I reckon there's no config issues, like capability and deleteIndexesAllowed has been configured for the index already.

Labels (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

There is a known issue where Indexer cluster with multi-sites for the versions prior to 8.1.8 and 8.2.4. The symptoms are exactly the same as above description - the search's working fine and finds the events in question. But with "| delete" it fails to find events that you want to delete due to no primary buckets that can be searched by delete command.

- Fixed version: 8.1.8+ and 8.2.4+ ,

- Affected: versions in 8.1.0~8.1.7 or 8.2.0 ~ 8.2.3

- Workaround:  This may have some performance impact on SHC so you may want to use it when you hit the issue and revert it back.

@Anonymous, add the below and restart the CM.

[clustering] in server.conf

assign_primaries_to_all_sites = true

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

There is a known issue where Indexer cluster with multi-sites for the versions prior to 8.1.8 and 8.2.4. The symptoms are exactly the same as above description - the search's working fine and finds the events in question. But with "| delete" it fails to find events that you want to delete due to no primary buckets that can be searched by delete command.

- Fixed version: 8.1.8+ and 8.2.4+ ,

- Affected: versions in 8.1.0~8.1.7 or 8.2.0 ~ 8.2.3

- Workaround:  This may have some performance impact on SHC so you may want to use it when you hit the issue and revert it back.

@Anonymous, add the below and restart the CM.

[clustering] in server.conf

assign_primaries_to_all_sites = true

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...