IT data signing - Splunk Community

Deployment Architecture

The manual says

Block signing is not supported for distributed search.

I am wondering if I send data to multiple indexers, then ran the audit reports on each indexer rather than a search head, would IT data signing work?

Yes, it would work under those conditions. But it would also be really expensive.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...