There is no "deletion" as such from splunk indexes. The "| delete" command (which requires explicitly added capability for a role) only marks the event as "hidden" within an index but it is still contained in the index files on the indexers (which might not sit well with your compliance team). And there is no "update". Once the data is indexed, it stays in the index untill it rolls out to frozen.
That's why proper onboarding process is important - typically you'd ingest your data first into a test index with very short retention period. Only after confirming that your source is properly configured you switch the data to the production index.
