Documentation that Splunk Logs cannot be changed

[BTA_BT]

For splunk cloud platform. Where is it documented that splunk cloud logs cannot be changed? 

[bowesmana]

Splunk does not support changing logs at all - that is not what Splunk is, it is simply a repository where data is stored as read-only data.

I am not sure where it is documented though. Neither Splunk Cloud, nor Enterprise support the concept of changing raw data once ingested.

[inventsekar]

@BTA_BT

May we have the doc link pls 

Do you see the add comment or feedback on the lower page?!?! 

Did (could you pls) you submit comment / feedback?!?!

Thx and best regards 

[star_lord]

This is for Splunk Enterprise but it essentially applies for Splunk Cloud as well:

Immutability of indexed data

Once data has been added to an index, you cannot edit or otherwise change the data. You can delete all data from an index or you can delete, and optionally archive, individual index buckets based on policy, but you cannot selectively delete individual events from storage.

https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/in...