Once compressed, Splunk data cannot be changed


Once compressed, Splunk data cannot be changed? Can someone guide me to the proper reference article

Tags (1)
0 Karma


Hi @palisetty,
once indexed data cannot be changed in Splunk, it isn't a problem of compression: indexed data are stored in buckets and they aren't modifiable.

Immutability of indexed data
Once data has been added to an index, you cannot edit or otherwise change the data. You can delete all data from an index or you can delete, and optionally archive, individual index buckets based on policy, but you cannot selectively delete individual events from storage.

For more infos, see at as @to4kawa hinted to you in another answer.

It's also possible to check the data integrity ( ).


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...