Why do I get errors for index=__ALL__ when using | delete?

[ddrillic]

When deleting via index=xxx sourcetype=yyyy | delete I got the following page -

So, in addition to the proper index xxx report of 0 errors for the various indexers, I also got these lines for the different indexers. Why do they mean?

[dwaddle]

Some of the errors numbers look an awful lot like an integer overflow/underflow. I'd say this is probably a bug, something treating an integer as signed in some places, unsigned in others ...

2^64 - 18446744073709539157 = 12459
2^64 - 18446744073709539122 = 12494

Both of these are really near the order of magnitude of other values of 'errors' in the screen shot. Smells plausible.

[ddrillic]

Very interesting!!!!!

[lguinn2]

Wow - I don't know what happened here, but you are deleting a boatload of data. It's possible that you have exceeded the design specs for the delete command.

I suggest that you search the internal log files for more information. Try this search, being sure to set the timerange to just around the time of the delete command:

index=_internal OR index=_audit log_level=error OR log_level=warn

Hopefully that will give you more info...

[ddrillic]

Perfect - let me try....

[ddrillic]

And the index=__ALL__ - what's that?