topic Re: Documentation that Splunk Logs cannot be changed in Splunk Cloud Platform

Documentation that Splunk Logs cannot be changed

BTA_BT — Wed, 20 Nov 2024 20:07:27 GMT

For splunk cloud platform. Where is it documented that splunk cloud logs cannot be changed?

Re: Documentation that Splunk Logs cannot be changed

inventsekar — Wed, 20 Nov 2024 22:49:07 GMT

@BTA_BT

May we have the doc link pls

Do you see the add comment or feedback on the lower page?!?!

Did (could you pls) you submit comment / feedback?!?!

Thx and best regards

Re: Documentation that Splunk Logs cannot be changed

bowesmana — Wed, 20 Nov 2024 23:16:02 GMT

Splunk does not support changing logs at all - that is not what Splunk is, it is simply a repository where data is stored as read-only data.

I am not sure where it is documented though. Neither Splunk Cloud, nor Enterprise support the concept of changing raw data once ingested.

Re: Documentation that Splunk Logs cannot be changed

star_lord — Thu, 13 Aug 2026 19:27:44 GMT

This is for Splunk Enterprise but it essentially applies for Splunk Cloud as well:

Immutability of indexed data

Once data has been added to an index, you cannot edit or otherwise change the data. You can delete all data from an index or you can delete, and optionally archive, individual index buckets based on policy, but you cannot selectively delete individual events from storage.

https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works#ariaid-title3