Archive

Splunk 4.2 and Broken Block Signatures

Explorer

Have anyone else experience busted block signing in 4.2?

Every install of 4.2 we have is not executing the block signature.

We can't tell if it is just not signing the data or if the Show Source check is failing for another reason.

E.

Tags (1)
1 Solution

SplunkTrust
SplunkTrust

This seems to be covered as an open issue in the 4.2 release notes:

http://www.splunk.com/base/Documentation/4.2/ReleaseNotes/KnownIssues

BlockSignature content validation does not work with distributed search.

BlockSignature content validation does not work in 4.2 (GA), even without distributed search, and will falsely claim the data has been tampered with. (SPL-38082)

View solution in original post

SplunkTrust
SplunkTrust

This seems to be covered as an open issue in the 4.2 release notes:

http://www.splunk.com/base/Documentation/4.2/ReleaseNotes/KnownIssues

BlockSignature content validation does not work with distributed search.

BlockSignature content validation does not work in 4.2 (GA), even without distributed search, and will falsely claim the data has been tampered with. (SPL-38082)

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!