Deployment Architecture

Why am able to see events even after deleting them from GUI?

siva_cg
Path Finder

Hi All,

We have a multisite clustered environment with 24 indexers and 8 search heads and all servers are running with 6.5.2 version.

We are deleting some of the events from Search Head GUI using delete command. But in the next day, we are able to see the events with the same query from GUI. Is there any reason why I am able to see the logs even after deleting from GUI?

Thanks in advance.

0 Karma
1 Solution

elliotproebstel
Champion

We had this same issue, and it persisted until we did a rolling restart of all indexers. We filed a Splunk support ticket, and that's the advice we were given. It was unsatisfying, but it worked.

View solution in original post

jhornsby
Splunk Employee
Splunk Employee

There are a number of issues with the way that |delete works in an indexer cluster in 6.5.2. You might want to upgrade to 6.5.4, which contains fixes for SPL-100516/SPL-136735 [Events deleted in an index cluster via the delete search operator may be inconsistently deleted on secondaries] and SPL-140333 [Disappearing cold bucket directories can wedge IndexerService thread (and others) while calculating bucket checksums].

0 Karma

elliotproebstel
Champion

We had this same issue, and it persisted until we did a rolling restart of all indexers. We filed a Splunk support ticket, and that's the advice we were given. It was unsatisfying, but it worked.

siva_cg
Path Finder

Thank you @elliotproebstel.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...