Why can deleted events reappear?

[HeinzWaescher]

Hi,

we're experiencing that deleted events reappear and are searchable again. It seems to happen randomly from time to time.
What can be the reason for this behaviour?

Thanks in advance
Heinz

[yannK]

Are you in an indexer cluster ?

[HeinzWaescher]

Yes, we are working in a cluster. And we are deleting events several times per week...
Can we do some kind of maintenance work to fix this list of hidden events?

[gfuente]

I found the same behaviour. In cluster. Deleted events reappeared after a deploy cluster bundle . Splunk 6.3.1

[Lowell]

Can you provide additional details about your environment? Single server, distributed, are you doing any index clustering/replication?

Keep in mind that events aren't truly "deleted" they are simply marked as hidden. So it's possible something is getting messed up in the file that contains the list of deleted events (per bucket). If you are deleting things regularly, you may want to look at why that is, as frequent deletes cause frequent bucket roles, which can impact performance.

Sounds like this may be a good candidate for a support ticket, especially if you can reproduce it or show multiple examples of when this has happened.

[jmallorquin]

Have you check the _indextime to check if the event is new?

Hope i help you

[HeinzWaescher]

Yes, I've checked the indextime. These are definitely old events.