Getting Data In

delete command timesout and is very slow

barne_dn
Explorer

I have old sources that were indexed in splunk. I'm trying to delete them but the | delete command is very slow and it always times out. I've already deleted the actual files from the disk, but from my understanding I also need to run the | delete command to the remove the indexed data. Is there a way to find out why it's so slow? I've even tried to narrow it down to ranges within in a day by specifying a custom time, but even then it times out.

Not sure if I have too many events in my main index and that's why it's become so slow and unusable. My main index (which is the one we use) is a bit over 250GB and has over 3 billion events.

Tags (1)
0 Karma
1 Solution

the_wolverine
Champion

Which version are you running? Sometime in version 3.x there was a bug which exhibited the same symptom that you report (slow to delete.)

One option is to run the same delete command from CLI:

./splunk search "your search terms startdaysago=2 enddaysago=1"

(verify by running search above first before running again with the added delete command)

./splunk search "your search terms | delete"

View solution in original post

0 Karma

the_wolverine
Champion

Which version are you running? Sometime in version 3.x there was a bug which exhibited the same symptom that you report (slow to delete.)

One option is to run the same delete command from CLI:

./splunk search "your search terms startdaysago=2 enddaysago=1"

(verify by running search above first before running again with the added delete command)

./splunk search "your search terms | delete"

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...