Deployment Architecture

When piping to delete in a search head cluster, does this get replicated to all search heads?

tkwaller
Builder

Hello

We have a large search head cluster that we saw the count of data spike on. Turns out, there's an issue with timestamps going BACKWARDS in time.
I've been creating props for these to clear up the issues and its been working as expected. After fixing, I run my search and pipe to the delete command, something like: index=* latest=-60d@d | delete

I run this command on one of the search heads (delete user is only allowed to log in on one search head), which is not the captain, and then go to Splunk Web and run the search again and nothing is changed.

My question is:
Once I pipe to the delete command, does this not replicate to all search heads? Do I need to re-push config bundles again?

Search head the delete user runs on:
index=* latest=-60d@d | delete
0 results found

Search head captain:
index=* latest=-60d@d | delete
3,269,183 events

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The data is stored on Indexers and the delete command just makes them un-searchable, so there is nothing special to be done search head cluster as such. How did you provide can_delete role to a user in just one Search Head? Did you update the file (authentication.conf)?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...