Can Splunk audit logs be deleted by a user who has access to the Splunk server?

[doncrittendon]

Is it possible for a user who has access to the Splunk server delete audit logs in splunk? Auditors do not want our developers to have the ability to delete Splunk audit logs. But, our developers do have access to the Splunk server.

How can I prove to the auditors that the logs within Splunk cannot be deleted?

[solarboyz1]

If a user has r/w access to the Splunk indexers filesystems, they can modify the indexes.

If you want to prove the data had not been modified, I recommend checking out data integrity:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Dataintegritycontrol