It looks like there is a known issue when upgrading Splunk 6.5.x to Splunk 6.6.2. http://docs.splunk.com/Documentation/Splunk/6.6.2/ReleaseNotes/KnownIssues#Upgrade_Issues I followed the guide and added $SPLUNK_HOME/etc/system/local/alert_actions.conf and added [email] sslVersions = *,-ssl2 cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH I then restarted the server and it was emailing again. ... View more

I realize this is an older post, but we ran into an issue with "| delete" when we upgraded to 6.5. The issue was that the events flagged for deletion would eventually reappear in Splunk; typically after a cluster restart. Splunk would not apply the delete journals across the cluster when running | delete from the search head (single search head, not SHC). The workaround we were given was to put the cluster into maintenance mode, then log into each indexer and run the delete command on each individual indexer. We automated this to a point using REST calls. We were monitoring delete requests using a lookup and would insert the source deleted, request number, and any other comments. I scheduled a search to look for data from these sources on an hourly basis (reloaded sources were suffixed with "_RELOAD_01". Files reappear if they are not deleted using this workaround. Word from support is they have identified the issue, and a fix is incoming for 6.5.2. ... View more