It says that when you delete a data source, the events in the ELM are no longer searchable. It's not quite I want but close, and since it's an old post, I ignore if it still working like that.
I also thought about changing the retention pool of the data source and make it shorter, to delete only old events, but I don't know if that would work and If it can be done in a single data source without affecting other data sources.
Either option you use will not actually delete the information, it will mark it as available space. This works similar to how windows deletes information. If you would like to suggest this as a feature for the ELM please submit the product idea:
Try to connect to the ELM via SFTP. I didn't test deletion but "Delete" button is actually available to click in WinSCP. You just have to find specific file with logs you want to delete, be careful to no delete something you (or compliance) need.
Hi, sorry for taking so long to give feedback, I tried login via SFTP but the files are all in read only, so you cannot delete them 😞
At the end I had to remove the asset and the events are marked as avaliable space, but it works for me, it will be deleted eventually and you cannot access it normally, it's not great because it deleted more events that I wanted, but it seems the only solution for now.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.