When deleting via index=xxx sourcetype=yyyy | delete I got the following page -
index=xxx sourcetype=yyyy | delete
So, in addition to the proper index xxx report of 0 errors for the various indexers, I also got these lines for the different indexers. Why do they mean?
Some of the errors numbers look an awful lot like an integer overflow/underflow. I'd say this is probably a bug, something treating an integer as signed in some places, unsigned in others ...
2^64 - 18446744073709539157 = 12459
2^64 - 18446744073709539122 = 12494
Both of these are really near the order of magnitude of other values of 'errors' in the screen shot. Smells plausible.
Wow - I don't know what happened here, but you are deleting a boatload of data. It's possible that you have exceeded the design specs for the delete command.
I suggest that you search the internal log files for more information. Try this search, being sure to set the timerange to just around the time of the delete command:
index=_internal OR index=_audit log_level=error OR log_level=warn
Hopefully that will give you more info...
Perfect - let me try....
And the index=__ALL__ - what's that?