Hi @LearningGuy, the approach is correct, but only you can know if the search before the delete command is correct. about the Users menu, probably you're working on a Search Head Cluster, so normal...
See more...
Hi @LearningGuy, the approach is correct, but only you can know if the search before the delete command is correct. about the Users menu, probably you're working on a Search Head Cluster, so normal users cannot modify users roles, contact an admin to make this action . Only one additiona information that I forgor in my first answer: the delete command runs a logical deletion, not a physical deletion, in other words, it marks the events as "deleted" and you don't see them more but they remain in the buckets until the bucket is discarded. Ciao. Giuseppe