Splunk attempting to login to switch?

[haxtonj]

I just installed new switches in my network and I am seeing multiple failed ssh login attempts coming from our Splunk server IP. Is this a function in Splunk that can be disabled?

[gcusello]

Hi @haxtonj,
If you're sure that the Splunk Server is trying to ssh login to the switch, you should check if your Splunk is using an App to extract logs from your switch and eventually disable it.
For my knowledge there isn't any other reason to do this.
Ciao.
Giuseppe