Getting Data In
Highlighted

How come some data returns after doing pipe delete and a restart of indexers?

Communicator

We're having issues when we delete some data (with |delete) and after an indexer restarts in the clustered environment, some of the data replicated again. I did some research and found that this was a previous bug (SPL-100516). Has it been fixed?

Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Splunk Employee
Splunk Employee

This is a known issue that is being addressed by engineering.

Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Communicator

Is there a workaround for deleting files and making sure they're gone?

Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Contributor

Why is this SPL not listed on the Known Issues page for the latest release?

0 Karma
Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Splunk Employee
Splunk Employee

Not sure, but I am having that addressed by the docs team.

Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Contributor

Thank you!

0 Karma
Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Splunk Employee
Splunk Employee

Current workaround:

5 minutes after executing the search which deletes events, manually execute:

$SPLUNK_HOME/bin/splunkd apply-delete-journals

on the indexes/buckets from which data was deleted.

Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Splunk Employee
Splunk Employee

Which version of Splunk are you running?

0 Karma
Highlighted

Re: How come some data returns after doing pipe delete and a restart of indexers?

Communicator

We are running 6.4.1

0 Karma