Erasing Search Results from the Analytics Engine in the Log Monitoring Application
You can erase the events returned from a search while keeping the search itself. The events that return from a search were indexed by the Analytic Engine, so erasing events removes the events from the Analytics Engine.
Tip: If you have a monitoring policy that captured some events that you want to monitor and some that you do not, perform a search that returns the events you do not want and erase those events.
Before You Begin
- Save a search.
- Open the saved search:
- At the upper left of the page, click Search.
- On the Search page, select the search that you want to use.
Tip: If you do not see a list of searches, on the right side of the page, click Show History.
You must have the Delete Monitoring Policy permission at the monitoring policy level. For information on permissions, see Permissions and Permitted Actions by Feature.
- At the upper right of the Search page, click Actions > Erase.
- In the warning message box, click Yes.
The warning message displays the number of events that will be deleted.