Yes you can delete the events using
| delete command, make sure that you are adding the pipe right after your base search. Here are the delete command description and the link,
Makes events irretrievable from the Splunk Enterprise indexes. Caution: Removing data is irreversible. If you want to get your data back after the data is deleted, you must re-index the applicable data sources.
Hope this will helps you.
Excuse me, but I probably misspoke!
My problem is that I loaded wrong events in a tsidx index using the tscollect command (BlueCoat App) and now I don't know how to delete them because I cannot use the "| delete" command after a non-streaming command 'tstats'.
How can I search events loaded in a tsidx index and delete them?
The load search is:
`bcoat_request`| rex field=source "(?(Proxy|Users)_.*)" | table _time action bytes_in bytes_out category cs_uri_path cs_uri_scheme cs_uri_extension dest_host filter_result http_content_type http_referrer http_user_agent sc_status src_ip src_user x_bluecoat_application_name x_virus_id dvc_ip proxysource | tscollect namespace=bluecoat_stats
It's the Splunk App for BlueCoat standard load search, the only difference is that I extract an additional field (