Can default indexes be edited and deleted in Splunk Cloud?

In Splunk Cloud, default indexes are not editable or deletable. The architecture of Splunk Cloud is designed to maintain certain core functionalities and integrity by preventing changes to default indexes once they are established. These default indexes, which include _internal, _audit, _telemetry, and others, serve critical roles in various operations and logging within the platform.

Thus, while you can create new indexes or modify how data is handled in those custom indexes, default indexes remain static to ensure consistent data tracking and integrity across the environment. Any attempt to edit or delete these default indexes would potentially disrupt data management and analytics, which is why such actions are prohibited in Splunk Cloud. This design choice helps prevent accidental loss of vital data and provides a consistent baseline for various functionalities within Splunk.

Understanding this aspect of Splunk’s architecture is crucial for effective administration and optimal use of Splunk Cloud.