You are searching on data that has already been indexed in Splunk.
The concept of an "update" doesn't really apply as it might in the database world with SQL.
There is a Splunk "delete" search command that will "soft" delete events from the search results.
And you can certainly "insert" new events via the REST API using the Receivers endpoints, and then subsequent searches can operate on this newly inserted data. Easiest to do this using an SDK from dev.splunk.com
Indexed data is diffult to modify is it?
Can i access the data directly from the splunk server and update the data directly using the rest api without searching? Or it is impossible like what you mentioned ?