I've heard that once data is indexed, it cannot be modified. Is that documented somewhere?

[gregbo]

I know that once an event is indexed, it cannot be modified. But is that specifically stated somewhere in the Documentation? I need to provide proof of it for security documentation.

[gjanders]

It depends what you consider valid evidence, How Splunk Stores Indexes states "Data rolled from hot. There are many warm buckets. Data is not actively written to warm buckets. "

Revealing the Magic - The Lifecycle of a Splunk Search is a 2017 conf presentation but a bit more explicit:
"Warm buckets are event immutable"

Also manage data integrity is based on computing hashes of raw data in a warm bucket and therefore that makes no sense if your allowed to modify the data...however I'm not sure if that's good enough...