Getting Data In

Delete job issue

SergeySH
New Member

Hello!

I faced with issue when I'm trying to delete old events using command " | delete". I find all events that I need in date range and then enter | delete command. After that scan is started and never ended. In job inspector I see component "dispatch.fetch.rcp.phase_0" with increasing Invocations and duration values. What could cause this issue? Why the delete job was not finished? Splunk Enterprise Server 7.2.5.1, two indexes in cluster, two search head in cluster.

Labels (1)
Tags (3)
0 Karma

FrankVl
Ultra Champion

Can you perhaps add a screenshot of how you are doing the |delete command?

0 Karma

SergeySH
New Member
 

@FrankVl

sure:
delete command.png

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...