Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Piping to delete in a search head clustered environment

$
0
0
Hello We have a large search head cluster that we saw the count of data spike on. turns out theres an issue with timestamps going BACKWARDS in time. I've been creating props for these to clear up the issues and its been working as expected. After fixing I run my search and pipe to the delete command, something like: index=* latest=-60d@d | delete I run this command on one of the search heads(delete user is only allowed to login on one search head), which is not the captain, and then go to splunk web and run the search again and nothing is changed. My question is: Once I pipe to the delete command does this not replicate to all search heads? Do I need to re-push config bundles again? Search head the delete user runs on: index=* latest=-60d@d | delete 0 results found Search head captain: index=* latest=-60d@d | delete 3,269,183 events

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>