Monitoring Splunk

Need help with Event & Data Loss or Modification & where to enable / check Event IT data block signing. Thanks mills.


Need help hardening Splunk with the following brothers / sisters Thank u in advance.

Where do I enable Indexer Acknowledgement. To ensure delivery of data from FWs to Indexers. When enabled the FW will send any data not acknowledged as received by the Indexer.

Where do I enable Event & data block signing? To meet regulatory requirement. How do I ensure if Audit events & archives are cryptographically signed. To help detect any modifications or tampering of underlying data.

I appreciate your help in advance



Labels (1)
Tags (1)
0 Karma


Mate, why don't you hire some professional company to manage your Splunk for you? It's not that I'm trying to be mean to you. It's just that judging from your questions ranging from writing searches to splunk installation maintenance it seems that someone threw an existing installation on you and you're supposed to provide support on all layers of this setup. It's kinda non-efficient and counter-productive. Especially if you have additional regulatory obligations it's hard for you to maintain the proper posture.

So, get some external help, meanwhile invest in some training and then you'll be able to take care of your servers.


0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...