Is it possible to disable encryption (SSL) between a search head and indexers?

[lbogle]

Hello Splunkers,
I would like to disable SSL between our Search Head and our indexers which are distributed in locations world wide. It appears that the Enterprise Security app is running searches in the background and this is generating a high volume of traffic from our indexers to the search head and this is impacting the bandwidth at those sites. Each of these sites has a traffic optimization technology that would take the volume of traffic and reduce it to a fraction of it's existing volume and is itself encrypted before it leaves our firewall. The problem is that the optimizers cannot read the encrypted Splunk traffic due to the optimization. Can it be disabled? If so, how? Considering the scenario, would it be recommended?
Thanks!

[lguinn2]

From server.conf.spec, I quote

[sslConfig]
    * Set SSL for communications on Splunk back-end under this stanza name.
        * NOTE: To set SSL (eg HTTPS) for Splunk Web and the browser, use web.conf.
    * Follow this stanza name with any number of the following attribute/value pairs.  
    * If you do not specify an entry for each attribute, Splunk will use the default value.

enableSplunkdSSL = true|false
    * Enables/disables SSL on the splunkd management port (8089) and KV store port (8191).
    * Defaults to true.
    * Note: Running splunkd without SSL is not generally recommended. 
    * Distributed search will often perform better with SSL enabled.

In $SPLUNK_HOME/etc/system/local/server.conf you could set

[sslConfig]
enableSplunkdSSL = false

on both the indexers and the search heads. It isn't recommended for security reasons. Other things (like forwarder management) might become wonky, I don't know - you should test it.