Getting Data In

Why can deleted events reappear?

HeinzWaescher
Motivator

Hi,

we're experiencing that deleted events reappear and are searchable again. It seems to happen randomly from time to time.
What can be the reason for this behaviour?

Thanks in advance
Heinz

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Are you in an indexer cluster ?

0 Karma

HeinzWaescher
Motivator

Yes, we are working in a cluster. And we are deleting events several times per week...
Can we do some kind of maintenance work to fix this list of hidden events?

0 Karma

gfuente
Motivator

I found the same behaviour. In cluster. Deleted events reappeared after a deploy cluster bundle . Splunk 6.3.1

0 Karma

Lowell
Super Champion

Can you provide additional details about your environment? Single server, distributed, are you doing any index clustering/replication?

Keep in mind that events aren't truly "deleted" they are simply marked as hidden. So it's possible something is getting messed up in the file that contains the list of deleted events (per bucket). If you are deleting things regularly, you may want to look at why that is, as frequent deletes cause frequent bucket roles, which can impact performance.

Sounds like this may be a good candidate for a support ticket, especially if you can reproduce it or show multiple examples of when this has happened.

0 Karma

jmallorquin
Builder

Have you check the _indextime to check if the event is new?

Hope i help you

0 Karma

HeinzWaescher
Motivator

Yes, I've checked the indextime. These are definitely old events.

0 Karma