How to verify whether the soft deleted data purged from Buckets?

[jeyakumar8]

Hi Team,

I have deleted few old data using "delete" command in Splunk. But i like to know whether any way to check if the data events are deleted from the indexer buckets.

Thanks in advance!

[gcusello]

HI @jeyakumar8,

the delete command makes a logical removal, not a physical removal (these events are marked as "deleted" but not removed from the bucket), so you can check the removal running a search for these data tha will not be available.

The physical removal will happen when the bucket containing these data will be removed at the end of the retention period.

Ciao.

Giuseppe