How do you delete data older then 13M that has been reindexed?

[RobertWengewicz]

We recently upgraded our infrastructure and placed the appliances in a different location so I needed to move the data, inject back into envision and it was reindexed of the data that it was injected. So I have data from October and November ot 2009 that I want to get rid of but can't because LSMaint doesn't see it.

So how can it be removed, As I will be scheduleling a process to delete -13M at the 1st of everymonth.

Thanks

Bob

[RSAAdmin]

You can't - not without deleting the "current" packages.

As you pointed out, when you inject data you are forcing the collector service to apply the current timestamp to the index.

If this data is not comingled with truly current events within the packets from the same device, then you can simply use lsmaint to delete the packages you injected.

There is no method for cherry-picking and removing individual events from within the packages.

[RSAAdmin]

Why did you reinject the data? You could just move the IPDB and reindex the data, so it would keep it's origional timestamp.

[RobertWengewicz]

RSA support told me I needed to do that in order for enVision to be able to see the data.

[RSAAdmin]

You should talk to support again as you do not Reinject data you move it and reindex as stated previously.