In Indexing phase, once data is written to disk, it cannot be changed

[palisetty]

In Indexing phase, once data is written to disk, it cannot be changed, I think the answer is YES. Kindly explain more in a line or two

[richgalloway · Accepted solution]

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Howindexingworks#Immutability_of_indexed...

[to4kawa]

see: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Howindexingworks