Getting Data In

Delete job issue

SergeySH
New Member

Hello!

I faced with issue when I'm trying to delete old events using command " | delete". I find all events that I need in date range and then enter | delete command. After that scan is started and never ended. In job inspector I see component "dispatch.fetch.rcp.phase_0" with increasing Invocations and duration values. What could cause this issue? Why the delete job was not finished? Splunk Enterprise Server 7.2.5.1, two indexes in cluster, two search head in cluster.

Labels (1)
Tags (3)
0 Karma

FrankVl
Ultra Champion

Can you perhaps add a screenshot of how you are doing the |delete command?

0 Karma

SergeySH
New Member
 

@FrankVl

sure:
delete command.png

 

0 Karma
Get Updates on the Splunk Community!

Upcoming Community Maintenance: 10/28

Howdy folks, just popping in to let you know that the Splunk Community site will be in read-only mode ...

Best Practices for Metrics Pipeline Management

We can’t guarantee the health of our services or a great user experience without data from our applications. ...

New Case Study: How LSU’s Student-Powered SOCs and Splunk Are Shaping the Future of ...

Louisiana State University (LSU) is shaping the next generation of cybersecurity professionals through its ...