Getting Data In

Why do I get errors for index=__ALL__ when using | delete?

ddrillic
Ultra Champion

When deleting via index=xxx sourcetype=yyyy | delete I got the following page -

alt text

So, in addition to the proper index xxx report of 0 errors for the various indexers, I also got these lines for the different indexers. Why do they mean?

Tags (2)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

Some of the errors numbers look an awful lot like an integer overflow/underflow. I'd say this is probably a bug, something treating an integer as signed in some places, unsigned in others ...

2^64 - 18446744073709539157 = 12459
2^64 - 18446744073709539122 = 12494

Both of these are really near the order of magnitude of other values of 'errors' in the screen shot. Smells plausible.

0 Karma

ddrillic
Ultra Champion

Very interesting!!!!!

0 Karma

lguinn2
Legend

Wow - I don't know what happened here, but you are deleting a boatload of data. It's possible that you have exceeded the design specs for the delete command.

I suggest that you search the internal log files for more information. Try this search, being sure to set the timerange to just around the time of the delete command:

index=_internal OR index=_audit log_level=error OR log_level=warn

Hopefully that will give you more info...

0 Karma

ddrillic
Ultra Champion

Perfect - let me try....

0 Karma

ddrillic
Ultra Champion

And the index=__ALL__ - what's that?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!