Hello,
We’re looking to remove data from one of our indexes, preferably using the clean operator from the CLI.
We have the some sources like “Perfmon:CPU Load” and “WinEventLog:System” – What would the correct clean syntax be to remove these sources from disk in the CLI be please?
Thanks
There is no way to remove selectively data from a bucket/index.
you can only hide it using the "|delete" command
or delete all data with the "clean" command