https://community.splunk.com/t5/Deployment-Architecture/IT-data-signing/m-p/60934#M2052 <P>Yes, it would work under those conditions. But it would also be really expensive. </P> Tue, 29 May 2012 16:04:59 GMT jbsplunk 2012-05-29T16:04:59Z https://community.splunk.com/t5/Deployment-Architecture/IT-data-signing/m-p/60933#M2051 <P>The manual says </P> <BLOCKQUOTE> <P>Block signing is not supported for distributed search.</P> </BLOCKQUOTE> <P>I am wondering if I send data to multiple indexers, then ran the audit reports on each indexer rather than a search head, would IT data signing work?</P> Fri, 25 May 2012 17:27:19 GMT https://community.splunk.com/t5/Deployment-Architecture/IT-data-signing/m-p/60933#M2051 imacdonald2 2012-05-25T17:27:19Z https://community.splunk.com/t5/Deployment-Architecture/IT-data-signing/m-p/60934#M2052 <P>Yes, it would work under those conditions. But it would also be really expensive. </P> Tue, 29 May 2012 16:04:59 GMT https://community.splunk.com/t5/Deployment-Architecture/IT-data-signing/m-p/60934#M2052 jbsplunk 2012-05-29T16:04:59Z