Deployment Architecture
Highlighted

Why am able to see events even after deleting them from GUI?

Explorer

Hi All,

We have a multisite clustered environment with 24 indexers and 8 search heads and all servers are running with 6.5.2 version.

We are deleting some of the events from Search Head GUI using delete command. But in the next day, we are able to see the events with the same query from GUI. Is there any reason why I am able to see the logs even after deleting from GUI?

Thanks in advance.

0 Karma
Highlighted

Re: Why am able to see events even after deleting them from GUI?

We had this same issue, and it persisted until we did a rolling restart of all indexers. We filed a Splunk support ticket, and that's the advice we were given. It was unsatisfying, but it worked.

View solution in original post

Highlighted

Re: Why am able to see events even after deleting them from GUI?

Explorer

Thank you @elliotproebstel.

0 Karma
Highlighted

Re: Why am able to see events even after deleting them from GUI?

Splunk Employee
Splunk Employee

There are a number of issues with the way that |delete works in an indexer cluster in 6.5.2. You might want to upgrade to 6.5.4, which contains fixes for SPL-100516/SPL-136735 [Events deleted in an index cluster via the delete search operator may be inconsistently deleted on secondaries] and SPL-140333 [Disappearing cold bucket directories can wedge IndexerService thread (and others) while calculating bucket checksums].

0 Karma