How do I delete incidents from Splunk ES

[lbogle]

Hello Splunkers,
ES was recently deployed in our environment and some incidents were created as part of testing functionality. I now have a bunch of erroneous incidents that are messing with my data. How do I delete them and clean the slate?
Thanks.

[esix_splunk]

If you are referring to the Notable events, these are managed through the Incident Review framework in ES. You select the events and edit them, from there you can change the status of the events to closed. See the documentation at :

http://docs.splunk.com/Documentation/ES/latest/User/IncidentReviewdashboard

If you want to delete the events completely, this is a bit more complex as the Notables are stored in a combination of the Notables index, and on local lookup files on the ES SH.