Getting Data In

Why can deleted events reappear?

Motivator

Hi,

we're experiencing that deleted events reappear and are searchable again. It seems to happen randomly from time to time.
What can be the reason for this behaviour?

Thanks in advance
Heinz

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Are you in an indexer cluster ?

0 Karma

Motivator

Yes, we are working in a cluster. And we are deleting events several times per week...
Can we do some kind of maintenance work to fix this list of hidden events?

0 Karma

Motivator

I found the same behaviour. In cluster. Deleted events reappeared after a deploy cluster bundle . Splunk 6.3.1

0 Karma

Super Champion

Can you provide additional details about your environment? Single server, distributed, are you doing any index clustering/replication?

Keep in mind that events aren't truly "deleted" they are simply marked as hidden. So it's possible something is getting messed up in the file that contains the list of deleted events (per bucket). If you are deleting things regularly, you may want to look at why that is, as frequent deletes cause frequent bucket roles, which can impact performance.

Sounds like this may be a good candidate for a support ticket, especially if you can reproduce it or show multiple examples of when this has happened.

0 Karma

Builder

Have you check the _indextime to check if the event is new?

Hope i help you

0 Karma

Motivator

Yes, I've checked the indextime. These are definitely old events.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!