Index Fidelity for Audit Purposes, proof.

[JDukeSplunk]

I've looked through the Splunk documentation for something that says "Once data is indexed, it cannot be edited". I can't find it. We are using Splunk to as evidence in a number of our audit items and we must prove that the data in Splunk is as accurate.

I know this to be true, but I want a pdf I can link them to. Does anyone have a link that isn't back to answers.splunk.com?

[lfedak_splunk · Accepted solution]

Hi @jdukesplunk, I'm actually working on staging this as a new page to the Splunk site. The content is pending final approval. This is live currently on NIAP. Splunk has (ISO 27001) certification and Splunk Cloud was certified by third-party auditors to meet SOC2 Type II, SOC3, and ISO 27001 standards. Further info about certifications will be available online really soon, I think by Sept. 1.

[cpetterborg]

I asked a similar question on answers a while back. Our Sales Engineer (James Brodsky - who is awesome, BTW) looked into it and posted a Blog posting on it at this link:

https://www.splunk.com/blog/2015/10/28/data-integrity-is-back-baby.html

I hope this helps.

[adonio]

i am not sure by your nickname whether you are working for Splunk or not but i do recall attempts to use Splunk data as an evidence in trial in the past. maybe worthwhile exploring directly through your sales rep or SE if you are not an employee.
regardless, the statement "Once data is indexed, it cannot be edited" is untrue
but yet again, i am not 100% positive of why you need that assurance
hope it helps