Deployment Architecture

Unable to delete search results

sylim_splunk
Splunk Employee
Splunk Employee

We are using 8.2.3 with SHC and multisite indexer clustering.

We have some mismatch on key business data and we need to delete and reload some data from the summary index only for a few days.

The below search returns data which is wrong and to be deleted.

Search:  index=INDEXNAME sourcetype=stash source=SOURCENAME datasource="DATASOURCENAME" host=HOSTNAME

But when I add "| delete" for the search above.  It deletes 0 events and no error.

delete_81_82.png
This worked a few months ago but not today so I reckon there's no config issues, like capability and deleteIndexesAllowed has been configured for the index already.

Labels (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

There is a known issue where Indexer cluster with multi-sites for the versions prior to 8.1.8 and 8.2.4. The symptoms are exactly the same as above description - the search's working fine and finds the events in question. But with "| delete" it fails to find events that you want to delete due to no primary buckets that can be searched by delete command.

- Fixed version: 8.1.8+ and 8.2.4+ ,

- Affected: versions in 8.1.0~8.1.7 or 8.2.0 ~ 8.2.3

- Workaround:  This may have some performance impact on SHC so you may want to use it when you hit the issue and revert it back.

@cm, add the below and restart the CM.

[clustering] in server.conf

assign_primaries_to_all_sites = true

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

There is a known issue where Indexer cluster with multi-sites for the versions prior to 8.1.8 and 8.2.4. The symptoms are exactly the same as above description - the search's working fine and finds the events in question. But with "| delete" it fails to find events that you want to delete due to no primary buckets that can be searched by delete command.

- Fixed version: 8.1.8+ and 8.2.4+ ,

- Affected: versions in 8.1.0~8.1.7 or 8.2.0 ~ 8.2.3

- Workaround:  This may have some performance impact on SHC so you may want to use it when you hit the issue and revert it back.

@cm, add the below and restart the CM.

[clustering] in server.conf

assign_primaries_to_all_sites = true

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...