How to delete events from an indexer?

[mojgh94]

Hi
I wanna delete Events from an indexer (x).
First of all, I added "delete_by_keyword" capability for admin then I wrote :

index=x suid=th:0 |eval index="x" |delete   

in the search& report app
I saw " error: you don't have capability to delete from index x"
How can I solve it?

[richgalloway · Accepted solution]

You need to grant admin the 'can_delete' role.

[skoelpin]

With great power, comes great responsibility!