How Do I Delete Old Data?

Immediate Insight automatically ages out and removes records that are older than TTL, the TTL is configurable per collector.

However if you later reduce the configured TTL for a collector, Immediate Insight does not retroactively go back and delete the older records (which were still valid under the old TTL setting).

To delete this older data, you can choose a Custom Time Period in Search, then Click Search, then Delete Result Records from the results to bulk delete old records that are already in the system under a different TTL. For example to delete data between 14 and 7 days old:

immin_delete

You can also Search for certain types (Search strings) of data you are no longer interested in (e.g. informational records), and Delete these Result Records.