Deployment Architecture

IT data signing

Path Finder

The manual says

Block signing is not supported for distributed search.

I am wondering if I send data to multiple indexers, then ran the audit reports on each indexer rather than a search head, would IT data signing work?

Splunk Employee
Splunk Employee

Yes, it would work under those conditions. But it would also be really expensive.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!