When applying event hashing, Splunk currently adds a hidden field to the event showing whether or not the current hash values match with the hash values from index time.
Is there a way to display the original and current hash values for a given event to prove that Splunk's judgement is accurate?
(Picky government customer)
A new hashing solution will be available in next version.
As of Splunk 6.2 this really isn't relevant anymore:
http://docs.splunk.com/Documentation/Splunk/6.2.2/releasenotes/Deprecatedfeatures
Features removed
IT data block signing
Audit signing
Event hashing
PDF Report Server App