Block Signing in Distributed Search Environment

[Mahieu]

Hello Splunkers,

I'd like to configure Block Signing in an environment where I have two indexers in a cluster and a search head for distributed search on these two indexers.

From http://answers.splunk.com/answers/105289/difference-between-event-hashing-and-it-block-signing it looks like IT block signing is not available when distributed search is running.

I'm quite confused as it's an important feature in some tricky environments.

Is there a way to go around ?
Is there any roadmap regarding this feature ? I've seen that it's deprecated too so it doesn't look to good but ...

Thanks in advance for your help.

M.

[Nomios · Accepted solution]

Hello,

Looks like the engineering team is working on it. Hopefully we'll have it soon.

[Mahieu]

Hello,

Can anyone from Splunk help maybe ?

Thanks a lot in advance.