Required suggestion for data deletion and Update on splunk index?

[ASorathiya1986]

Can you please suggest the following?

 

We are looking to delete/update particular indexed data from the splunk programmatically via python add-on code during data import to the Splunk.

[PickleRick]

There is no "deletion" as such from splunk indexes. The "| delete" command (which requires explicitly added capability for a role) only marks the event as "hidden" within an index but it is still contained in the index files on the indexers (which might not sit well with your compliance team). And there is no "update". Once the data is indexed, it stays in the index untill it rolls out to frozen.

That's why proper onboarding process is important - typically you'd ingest your data first into a test index with very short retention period. Only after confirming that your source is properly configured you switch the data to the production index.