How do you delete data older then 13M that has been reindexed?
We recently upgraded our infrastructure and placed the appliances in a different location so I needed to move the data, inject back into envision and it was reindexed of the data that it was injected. So I have data from October and November ot 2009 that I want to get rid of but can't because LSMaint doesn't see it.
So how can it be removed, As I will be scheduleling a process to delete -13M at the 1st of everymonth.
You can't - not without deleting the "current" packages.
As you pointed out, when you inject data you are forcing the collector service to apply the current timestamp to the index.
If this data is not comingled with truly current events within the packets from the same device, then you can simply use lsmaint to delete the packages you injected.
There is no method for cherry-picking and removing individual events from within the packages.