Delete job issue

SergeySH · ‎08-17-2020

Hello!

I faced with issue when I'm trying to delete old events using command " | delete". I find all events that I need in date range and then enter | delete command. After that scan is started and never ended. In job inspector I see component "dispatch.fetch.rcp.phase_0" with increasing Invocations and duration values. What could cause this issue? Why the delete job was not finished? Splunk Enterprise Server 7.2.5.1, two indexes in cluster, two search head in cluster.

FrankVl · ‎08-17-2020

Can you perhaps add a screenshot of how you are doing the |delete command?

SergeySH · ‎08-17-2020

@FrankVl

sure:
delete command.png

Delete job issue

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation

Delete job issue

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent