Hi , We am using an ES setup and have a 2 DAS connected to the RSA. We store events in one of the DAS and backup the same events on another. Perform scheduled daily backup for the same (lsmaint). Now we want to delete older events (say -6M) from RSA , but would like to retain the backup for the same. Checked the command ' -delete ' , it deletes all the events from even backup location. So can you suggest how to delete older events from Collector without deleting it from backup.
Checked the command "lsmaint -show -gmt -time start -6M >check.txt" it shows that it is looking for all the files, even from backup so if i perfrom delete action it would delete the same too.