Hello
We have a large search head cluster that we saw the count of data spike on. turns out theres an issue with timestamps going BACKWARDS in time.
I've been creating props for these to clear up the issues and its been working as expected. After fixing I run my search and pipe to the delete command, something like: index=* latest=-60d@d | delete
I run this command on one of the search heads(delete user is only allowed to login on one search head), which is not the captain, and then go to splunk web and run the search again and nothing is changed.
My question is:
Once I pipe to the delete command does this not replicate to all search heads? Do I need to re-push config bundles again?
Search head the delete user runs on:
index=* latest=-60d@d | delete
0 results found
Search head captain:
index=* latest=-60d@d | delete
3,269,183 events
↧