You get the warning because you exceeded the volume limit. It does not matter if you remove the data - the warning still counts, as the license is based on indexing volume, not storage volume. However, there is no reason to panic. The (visible) warning will go away tomorrow, and the actual warning will age out in 30 days. You're allowed 5 warnings in a rolling 30 day window before you get locked out.
As you've probably read in the docs, the delete command does not actually remove any data, it only removes the it from the index-file (.tsidx), i.e. removes the pointers to it. Unless it was a really huge amount of data, and you have disk space concerns, it's better to leave it as it is, and let it age out along with the other data according to the retention policy you have specified. If you did not specifically set such a policy, then event data will be purged (oldest first) from the index when it reaces 500GB in size or ~6 years age (whichever condition matches first).
Don't panic!
EDIT: typos and clarity
/K
