How come some data returns after doing pipe delete and a restart of indexers?

[dpanych]

We're having issues when we delete some data (with |delete) and after an indexer restarts in the clustered environment, some of the data replicated again. I did some research and found that this was a previous bug (SPL-100516). Has it been fixed?

[s2_splunk]

Which version of Splunk are you running?

[dpanych]

We are running 6.4.1

[s2_splunk]

This is a known issue that is being addressed by engineering.

[s2_splunk]

Current workaround:

5 minutes after executing the search which deletes events, manually execute:

$SPLUNK_HOME/bin/splunkd apply-delete-journals

on the indexes/buckets from which data was deleted.

[coltwanger]

Why is this SPL not listed on the Known Issues page for the latest release?

[s2_splunk]

Not sure, but I am having that addressed by the docs team.

[coltwanger]

Thank you!

[dpanych]

Is there a workaround for deleting files and making sure they're gone?