I have old sources that were indexed in splunk. I'm trying to delete them but the | delete command is very slow and it always times out. I've already deleted the actual files from the disk, but from my understanding I also need to run the | delete command to the remove the indexed data. Is there a way to find out why it's so slow? I've even tried to narrow it down to ranges within in a day by specifying a custom time, but even then it times out.
Not sure if I have too many events in my main index and that's why it's become so slow and unusable. My main index (which is the one we use) is a bit over 250GB and has over 3 billion events.