Monitoring Splunk

Need help with Event & Data Loss or Modification & where to enable / check Event IT data block signing. Thanks mills.


Need help hardening Splunk with the following brothers / sisters Thank u in advance.

Where do I enable Indexer Acknowledgement. To ensure delivery of data from FWs to Indexers. When enabled the FW will send any data not acknowledged as received by the Indexer.

Where do I enable Event & data block signing? To meet regulatory requirement. How do I ensure if Audit events & archives are cryptographically signed. To help detect any modifications or tampering of underlying data.

I appreciate your help in advance



Labels (1)
Tags (1)
0 Karma


Mate, why don't you hire some professional company to manage your Splunk for you? It's not that I'm trying to be mean to you. It's just that judging from your questions ranging from writing searches to splunk installation maintenance it seems that someone threw an existing installation on you and you're supposed to provide support on all layers of this setup. It's kinda non-efficient and counter-productive. Especially if you have additional regulatory obligations it's hard for you to maintain the proper posture.

So, get some external help, meanwhile invest in some training and then you'll be able to take care of your servers.


0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...