Deployment Architecture
Highlighted

IT data signing

Path Finder

The manual says

Block signing is not supported for distributed search.

I am wondering if I send data to multiple indexers, then ran the audit reports on each indexer rather than a search head, would IT data signing work?

Highlighted

Re: IT data signing

Splunk Employee
Splunk Employee

Yes, it would work under those conditions. But it would also be really expensive.