Deployment Architecture

When piping to delete in a search head cluster, does this get replicated to all search heads?

Builder

Hello

We have a large search head cluster that we saw the count of data spike on. Turns out, there's an issue with timestamps going BACKWARDS in time.
I've been creating props for these to clear up the issues and its been working as expected. After fixing, I run my search and pipe to the delete command, something like: index=* latest=-60d@d | delete

I run this command on one of the search heads (delete user is only allowed to log in on one search head), which is not the captain, and then go to Splunk Web and run the search again and nothing is changed.

My question is:
Once I pipe to the delete command, does this not replicate to all search heads? Do I need to re-push config bundles again?

Search head the delete user runs on:
index=* latest=-60d@d | delete
0 results found

Search head captain:
index=* latest=-60d@d | delete
3,269,183 events

0 Karma

Revered Legend

The data is stored on Indexers and the delete command just makes them un-searchable, so there is nothing special to be done search head cluster as such. How did you provide can_delete role to a user in just one Search Head? Did you update the file (authentication.conf)?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!