Why am able to see events even after deleting them from GUI?

[siva_cg]

Hi All,

We have a multisite clustered environment with 24 indexers and 8 search heads and all servers are running with 6.5.2 version.

We are deleting some of the events from Search Head GUI using delete command. But in the next day, we are able to see the events with the same query from GUI. Is there any reason why I am able to see the logs even after deleting from GUI?

Thanks in advance.

[jhornsby]

There are a number of issues with the way that |delete works in an indexer cluster in 6.5.2. You might want to upgrade to 6.5.4, which contains fixes for SPL-100516/SPL-136735 [Events deleted in an index cluster via the delete search operator may be inconsistently deleted on secondaries] and SPL-140333 [Disappearing cold bucket directories can wedge IndexerService thread (and others) while calculating bucket checksums].

[elliotproebstel · Accepted solution]

We had this same issue, and it persisted until we did a rolling restart of all indexers. We filed a Splunk support ticket, and that's the advice we were given. It was unsatisfying, but it worked.

[siva_cg]

Thank you @elliotproebstel.