Hi @palisetty,
once indexed data cannot be changed in Splunk, it isn't a problem of compression: indexed data are stored in buckets and they aren't modifiable.
Immutability of indexed data
Once data has been added to an index, you cannot edit or otherwise change the data. You can delete all data from an index or you can delete, and optionally archive, individual index buckets based on policy, but you cannot selectively delete individual events from storage.
For more infos, see at https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Howindexingworks as @to4kawa hinted to you in another answer.
It's also possible to check the data integrity ( https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/Dataintegritycontrol ).
Ciao.
Giuseppe
