Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time

[svercelli]

So I seem to have an issue similar to the one in this question here and have accidentally indexed over 1,000,000 events on the same second. I want to delete them but I can't because the search won't run because it will produce the same error as seen in the title. Is there any way to solve this without deleting the whole index?

[DalJeanis]

Try this - if it runs, then you should be able to delete it in chunks.

 earliest="the exact time you want to delete" | head 90000

[secrecys]

The

| head 90000

does not work...

[thambisetty]

Identify events with some unique keywords and use them in the search and then apply delete command. Of course earliest and latest time is required not to delete other events.