Getting Data In
Highlighted

delete command timesout and is very slow

Explorer

I have old sources that were indexed in splunk. I'm trying to delete them but the | delete command is very slow and it always times out. I've already deleted the actual files from the disk, but from my understanding I also need to run the | delete command to the remove the indexed data. Is there a way to find out why it's so slow? I've even tried to narrow it down to ranges within in a day by specifying a custom time, but even then it times out.

Not sure if I have too many events in my main index and that's why it's become so slow and unusable. My main index (which is the one we use) is a bit over 250GB and has over 3 billion events.

Tags (1)
0 Karma
Highlighted

Re: delete command timesout and is very slow

Champion

Which version are you running? Sometime in version 3.x there was a bug which exhibited the same symptom that you report (slow to delete.)

One option is to run the same delete command from CLI:

./splunk search "your search terms startdaysago=2 enddaysago=1"

(verify by running search above first before running again with the added delete command)

./splunk search "your search terms | delete"

View solution in original post

0 Karma